refactor the security design.  security belongs to the webapp as a whole, not to endpoints