replace our homebrew AA code with Flask-Security