many to many work, security don't work