user security + headerCtrl