You're right, it looks like there could be some concurrency issues here. In looking at how we handle this for other modifications to security.xml (e.g. change password), I'm not seeing any locking mechanism in place, so we may have existing issues in this area as well. I'll look into this more.