security_mirror: use /srv/ instead of deprecated /org/