I seem to be confused on how the security works for QF on OES2.

It seems that since Apache is the webserver on OES2, that I need to
confgure Apache to control the search results?

Or am I missing something?