only add user as a routing source if security is on
One more webapp to app