Where can a developer specify confidentiality or integrity constraints on communications with a Enterprise Bean exposed as a JAX-RS root resource?