warn about security in rest interface