diff --git a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
index 38c5bee..ce46d86 100644
--- a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
+++ b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
@@ -21,6 +21,7 @@
 
 import java.util.logging.Level;
 
+import org.apache.commons.lang.StringUtils;
 import org.restlet.Context;
 import org.restlet.Request;
 import org.restlet.Response;
@@ -60,7 +61,7 @@
 {
     public XWikiAuthentication(Context context) throws IllegalArgumentException
     {
-        super(context, ChallengeScheme.HTTP_BASIC, "XWiki");
+        super(context, ChallengeScheme.CUSTOM, "XWiki");
     }
 
     @Override
@@ -70,51 +71,38 @@ public boolean authenticate(Request request, Response response)
          * Browser authentication resource is a special resource that allows to trigger the authentication dialog box in
          * web browsers
          */
-        if (request.getResourceRef().getPath().endsWith(BrowserAuthenticationResource.URI_PATTERN)) {
-            return super.authenticate(request, response);
-        }
+ 
 
         ComponentManager componentManager =
             (ComponentManager) getContext().getAttributes().get(Constants.XWIKI_COMPONENT_MANAGER);
         XWikiContext xwikiContext = Utils.getXWikiContext(componentManager);
         XWiki xwiki = Utils.getXWiki(componentManager);
+        return trySessionAuthenticate(xwiki, xwikiContext);
+ 
+    }
 
-        /* By default set XWiki.Guest as the user that is sending the request. */
-        xwikiContext.setUser("XWiki.XWikiGuest");
-
-        Form headers = (Form) request.getAttributes().get(HeaderConstants.ATTRIBUTE_HEADERS);
 
-        if (headers.getValues(HeaderConstants.HEADER_AUTHORIZATION) == null) {
-            /*
-             * If there isn't an authorization header, check if the context contains an already authenticated session.
-             * If it's the case use the previously authenticated user.
-             */
-            try {
-                XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
-                if (xwikiUser != null) {
-                    // Make sure the user is absolute
-                    xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
-                        .getDatabase() + ':' + xwikiUser.getUser());
-                    getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", xwikiUser.getUser()));
-                }
-            } catch (XWikiException e) {
-                getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+    /**
+     * Tries to use the already authenticated session as the user of this request. In particular this will check if
+     * there is a cookie in the request to identify an already authenticated user.
+     *
+     * @param xwiki the XWiki current instance
+     * @param xwikiContext the XWikiContext the context of the request
+     */
+    private boolean trySessionAuthenticate(XWiki xwiki, XWikiContext xwikiContext)
+    {
+        try {
+            XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
+            if (xwikiUser != null) {
+                // Make sure the user is absolute
+                xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
+                    .getDatabase() + ':' + xwikiUser.getUser());
+                getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", xwikiUser.getUser()));
+                return true;
             }
-
-            /*
-             * If we are here, either the xwikiContext contained good credentials for a previously authenticated user or
-             * these credentials are no longer valid or an error occurred during authentication. We consider all these
-             * three cases as "successful". In the first case we have an authenticated user, in the other two cases we
-             * continue to process the request as "Guest".
-             */
-            return true;
+        } catch (XWikiException e) {
+            getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
         }
-
-        /*
-         * If we are here, then an authorization header is present in the request. Make Restlet process this request.
-         * The standard way it does this is by calling the checkSecret() method with the appropriate parameters.
-         */
-        return super.authenticate(request, response);
+        return false;
     }
-
 }
diff --git a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
index de97269..86306b9 100644
--- a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
+++ b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
@@ -29,6 +29,7 @@
 import com.xpn.xwiki.XWiki;
 import com.xpn.xwiki.XWikiContext;
 import com.xpn.xwiki.XWikiException;
+import com.xpn.xwiki.user.api.XWikiUser;
 
 /**
  * Secret verifier that authenticates the user against XWiki authentication system.
@@ -74,17 +75,54 @@ public boolean verify(String identifier, char[] secret) throws IllegalArgumentEx
 
                 xwikiContext.setUser(xwikiUser);
 
-                this.context.getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", identifier));
-
-                return true;
+                this.context.getLogger().log(
+                    Level.FINE,
+                    String.format("Authenticated as '%s'.", identifier)
+                );
+            } else {
+                this.context.getLogger().log(
+                    Level.WARNING,
+                    String.format("Could not authenticate as '%s'.", identifier)
+                );
+                // if we haven't been able to authenticate anyone using the authorization headers, check if the context
+                // contains an already authenticated session. If it's the case use the previously authenticated user.
+                trySessionAuthenticate(xwiki, xwikiContext);
             }
         } catch (XWikiException e) {
-            this.context.getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+            this.context.getLogger().log(
+                Level.WARNING, "Exception occurred while verifying authentication.", e
+            );
         }
 
-        this.context.getLogger().log(Level.WARNING, String.format("Cannot authenticate '%s'.", identifier));
-
-        return false;
+        // this will translate into a 1 being always returned by the authenticate method above, which is ok, the user
+        // will always be guest if authentication fails. In particular this means that REST will never return 401, but
+        // always use guest to perform the action, which is not rights escalation since it would mean that guest has
+        // more rights than authenticated user, which doesn't make sense.
+        return true;
     }
 
+    /**
+     * Tries to use the already authenticated session as the user of this request. In particular this will check if
+     * there is a cookie in the request to identify an already authenticated user.
+     * 
+     * @param xwiki the XWiki current instance
+     * @param xwikiContext the XWikiContext the context of the request
+     */
+    private void trySessionAuthenticate(XWiki xwiki, XWikiContext xwikiContext)
+    {
+        try {
+            XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
+            if (xwikiUser != null) {
+                // Make sure the user is absolute
+                xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
+                    .getDatabase() + ':' + xwikiUser.getUser());
+                this.context.getLogger().log(
+                    Level.FINE,
+                    String.format("Implicity authenticated as '%s'.", xwikiUser.getUser())
+                );
+            }
+        } catch (XWikiException e) {
+            this.context.getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+        }
+    }
 }
