rename SSL to security and add nonces and roles capabilities