not sure, but maybe access to plugins should maybe only be enabled if security is not enabled for this plugin...