adding security to rest api