probably fixing session issue in security.yml
other small bug fixes