The API call does not seems to really care about username/password

[allan-simon]

posting a new form works , with the httpie missing the -a parameters

[lsmith77]

right now the auth is only really relevant to decide on the serialization group:
https://github.com/gimler/symfony-rest-edition/blob/2.3/src/Acme/DemoBundle/Controller/NoteController.php#L98

but yeah .. I can see that one could expect it to be used more and it might make sense to expand the example to require the permissions also for write requests. motivated to work on this?