after some testing, the security code can stay in uninstall.php