add access control to rest server