removed in_memory user from security.yml