yes, I agree with your other comment, this should be `<security:config>`