Refactor security engine, supporting token based auth