allow multiple security actions for same server route