Re-add security to the wm_counters endpoint

cc @russelldb @engelsanchez I think this got lost as part of the refactor over in #697