separate security config
basic settings