I think it would be better to move registry._set_default_serializer('auth') to setup_security