basic security, mvc interceptor setup