applied security filter x-auth-token on api calls