support local authentication for REST API (in addition to HTTP Basic)