make calls to constantize as safe as possible

see: https://www.openproject.org/issues/2580

* let tests pass first
* have a look if the security checks are sufficient