It looks like security service is not properly integrated. We will need to use a service for security and push just two separate concerns there.