move security config to correct position, fix exception handling