securityStamp now has private setter