security everywhere.  also added private security class (for betweeen two same services only)