Completely reworked how special expirations are handled in security rules.