apply proper security config + use new auth source that uses servlet 3