How is security testing done in agile teams? A cross-case analysis of four software teams