I'm asking myself, if I should change the behaviour once more and just prevent touching the address book for secure payment-requests (green sendcoins UI), but allow it for insecure payment-requests (normal sendcoins UI). coinsSent would still be emited for both types, as paymentACK messages are received for secure and insecure ones.