security on view and service layer - TODO to other components