removed <security:http-basic /> from /api/** endpoints