fixed web-security setting