add security-core to security-web