re-organized security
now it works also the authenticated call