add security filter and AllowedRoles annotation