move status code handling from zibo.app to zibo.security