add security API
add security middleware