Fixed API path in security config