add allowAnonymous attribute to non-secure method