protect against REST calls