add AuthenticationFilter for REST access

Just a detail: I'm wondering if we should use ```statefull``` instead as our primary flows are statefull.