first draft of new user security doc