update security.rule