replace auth with flask-Security auth