adding first security config for OAuth2