slight refactor of Security.__getattr__ to avoid recussion when not initialized with app