add config setting to disable UI and config security mode
add role authorization check is security mode is not local