title: google app engine restful web service authentication
body: <p>I have created a simple Google App Engine web application with Spring MVC and JSP. This app 
  is configured so that only admin users allow to access. </p>
  
  <pre><code>&lt;security-constraint&gt;
     &lt;web-resource-collection&gt;
         &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
         &lt;http-method&gt;GET&lt;/http-method&gt;
         &lt;http-method&gt;POST&lt;/http-method&gt;
     &lt;/web-resource-collection&gt;
     &lt;auth-constraint&gt;
         &lt;role-name&gt;admin&lt;/role-name&gt;
     &lt;/auth-constraint&gt;
     &lt;user-data-constraint&gt;
         &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
     &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>It also contains several restful web service methods defined in a web controller. Clients for those methods could be a java app with Spring Rest Template or a Web Based Client.</p>
  
  <p>Since restful web service is stateless, how do I make every http request sent from client authenticated to GAE.</p>
  
  <p>The problem I am facing right now is the returned http response for every request contains google login page content.</p>