only deny access to security settings if security is enabled