added /user to security.yml