enable auth in rest calls, and fix one error message