diff --git a/wise-webapp/src/main/java/com/wisemapping/rest/AdminController.java b/wise-webapp/src/main/java/com/wisemapping/rest/AdminController.java
index 530b0f2c..447f4a43 100644
--- a/wise-webapp/src/main/java/com/wisemapping/rest/AdminController.java
+++ b/wise-webapp/src/main/java/com/wisemapping/rest/AdminController.java
@@ -128,8 +128,8 @@ public class AdminController extends BaseController {
         userService.deleteUser(user);
     }
 
-    @RequestMapping(method = RequestMethod.GET, value = "admin/database/purge")
     @ResponseStatus(value = HttpStatus.NO_CONTENT)
+    @RequestMapping(method = RequestMethod.GET, value = "admin/database/purge")
     public void purgeDB(@RequestParam(required = true) Integer muid, @RequestParam(required = true) Boolean apply) throws UnsupportedEncodingException, WiseMappingException {
 
         for (int i = 0; i < muid; i++) {
diff --git a/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml b/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
index a9367276..a821492d 100644
--- a/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
+++ b/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
@@ -37,6 +37,7 @@
 
     <sec:http use-expressions="true" create-session="stateless" pattern="/service/**">
         <sec:intercept-url pattern="/service/admin/users/**" access="isAuthenticated() and hasRole('ROLE_ADMIN')"/>
+        <sec:intercept-url pattern="/service/admin/database/**" access="isAuthenticated() and hasRole('ROLE_ADMIN')"/>
         <sec:intercept-url pattern="/service/**" access="isAuthenticated() and hasRole('ROLE_USER')"/>
         <sec:http-basic/>
     </sec:http>