Security Controllers are secured with expiring tokens. Request are validated based on the "X-Access-Token" header.