moved security from app/views to common