Security configuration should pass the URI of the security policy file rather than having EvalCode construct it.