added basic security config for token-based auth