add security middleware