add private property for reflector in security middleware