Update doc/manual/security.markdown
fix for a91b5e1ecb46; new records were returning true from linkable? which was messing up cancel links.
object_url: subsite=>"" is the standard way of specifying the front site
oops.   Yes, I have been running integration tests; but obviously not from a pristine source...
Merge remote-tracking branch 'hobodoc/master'