move get activity to after security check