refactor to use UserSecurityAttributes, keeping most demo the same
further refactor, and only enable 1 web end point for testing