fix REST security