use security infomation in role security handler