Controller method security configured by annotations