Strip securityContext injection

Turns out $event->getData() works for listeners as well, not just
dispatchers. With that in mind, this ditches a bunch of cruft.