Move web security configuration to application module