fix controller, views and forms to use security user