REST auth by default