Removes insecure package from project, so all client-side updates must now have allow and deny set.

Everything but "update" is disallowed for Panels, and even this will need to be limited to owners of the current dashboard at some point.