added security config to allow all requests