merge ejb and rest resources, secure ejb directly (always requires
authentication)