Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows Server 2008 server that our web site (web application) runs on. Our web application, which is running in IIS using PHP uses Curl (PHP library) to request data using JAX-WS web services. How should we protect these web services from getting called by the general public, so only our web application can only make requests?