change the security to use xml config