Fixes to security handlers to be more direct on whats allowed and whats not.