I think the `newSecurityManager` should be moved outside of the `try`, because `finally` (reset the manager) should only be run when the `newSecurityManager` call succeeds without