add security rules to apache_sites