refactor security.xml