Controlling access to RESTful Views