Add security tests for the client-less approach

This is to test that our mechanism to pass credentials from client to rest api calls works as expected