removed security on get all guests -> security should be enforced at higher level
made DurationModel human-readable