Central authentication service via HTTP/REST