secured annotations - rest, admin