Switch to join() based request handler to enforce security