how to apply security token service in a controller