secrity tag placed in app.rb