friend showed me how to steal the auth token from the browser session storage, so I can use it against the REST API. interesting how one can just do that. a browser plugin could steal your session and it wouldn't even be visible to the user?