security change to ReflectionFlowPropertyValueProvider.java