readjusted security.yml api access for tests