added missing security checks for the new api