fix api security middleware