Let the authenticated dispatcher do the job to create new window or
handle request without window name. The REST ( /url/ ) must only
redirect the request to it if the user is already authenticated.

and wording

New configuration panel every time the segment is clicked to prevent
loosing the state of the checkbox