Security annotations should be placed directly on controller methods