create new rest endpoints that are authenticated using browser session