I answered simply with to actually secure REST calls ensure there is client based authentication. Also you can pass tokens to ensure the user has the proper auth on the back end. They did not take this answer as correct and kept asking it in different ways without hinting at what could be wrong with my answer.