fix ticket #3138 Protect REST pages in not logged