web resource must implement access control resource interface