changed security.js to user.js