[keycloak-user] REST API security