update on security work for rest api