okay, seems to be that framework-bundle 2.3 does not require security yet. i am on it.