Security config must be loaded first