initialize SecurityAttributes only at the first call