Changed the SecurityRules implementation so that all the rules are held within our code (rather than the underlying Web Server).

This has the most immediate benefit of fixing a bug whereby we seem to overwrite previously registered security rules with ones we register later. Dunno how that escaped us when we were building this first time around.

A second side effect is that we're a bit more portable.

Also my IDE formatted a bunch of code to the house style.