[REST] change password #20 , #35

support REST calls (without redirecting) #35