Move security.js to route library