cleaned up and simplified newAppSec function