added comments on security.xml