rest and soap urls now require security. next step to tidy up amount of hibernate config as its scattered around the place. Then get credentials from db.