apply proper security config + use new auth source that uses servlet 3
improved config in order to fix BZ-973124