Security framework for web services