improvements

Let the authenticated dispatcher do the job to create new window or
handle request without window name. The REST ( /url/ ) must only
redirect the request to it if the user is already authenticated.

and wording