add files; tests pass and app deploys but security not working