I know this isn't part of the PR, but - this should be SecurityAction.FullDemand, not LinkDemand. Never expose link demands.