refactor: externalized security config to @Config class in user service