Decorate a query handler to push in a security class