add security to all web requests
add tests for authentication