My recommendation is to do security via modifying the interceptor chain for the resources you want to secure. security and cors is my current focus, but it's not easy to predict when I'll have them both done.