move security config into its own file
use in memory auth for now