more config changes to make app secure