Web API Security - securing controller access using featureidentifiers