refactor security config