Plugging a security domain in a web application