[MPFE-507] now security/actions can be defined as callbacks as well