Changing security, not working with rest requests