add security and roles to system
Not use the session to get the information of "user"