[koly] escapce /api in security for mobile restful apis