authentication moved to SecurityService