add UserBundle, security & routing