changed WebSecurity initialization