add security interface to attribute controller