refactoring security in webapp