adding ability to pass in capability_type_iids to with_query_security