Fallback security to root api if missing

lib/buildroutes.js

@@ -37,7 +37,7 @@ function buildroutes(options) {
                 name: operation.operationId,
                 description: operation.description,
                 method: verb,
-                security: buildSecurity(options.basedir, api.securityDefinitions, operation.security || def.security),
+                security: buildSecurity(options.basedir, api.securityDefinitions, operation.security || def.security || api.security),
                 validators: [],
                 handler : undefined,
                 consumes: operation.consumes || api.consumes,
@@ -151,8 +151,8 @@ function resolve(basedir, pathname, method) {
     var handler;
     try {
         //If the pathname is already a resolved function, return it.
-        //In the case of x-handler and x-authorize, users can define 
-        //external handler/authorize modules and functions OR override 
+        //In the case of x-handler and x-authorize, users can define
+        //external handler/authorize modules and functions OR override
         //existing x-authorize functions.
         if (thing.isFunction(pathname)) {
             return pathname;