security is not really needed in the project - but cleanup done anyway

Minor PR

These changes are not needed for the project but it's however a good practise to get rid of plain encoders and hardcoded passwords in the security.yml. For demo purposes I have changed the content a little bit. Passwords would be fetched from new parameters in databases.yml. Besides the demo stuff was removed (commented out).