Security yaml, more work on UserProvider