[keycloak-user] Best practice public API Rest (GET Method) Vs Protected