slight fix for a db with no security object set
lib/settings.js