Add example with security and API tests to verify that security works from "outside"