fix(security): authenticate extension services (#2638)