Differentiate browsers from REST clients

And use this information to determine the response to access without a
login.