Add <security:allowcoreunload>.

When enabled (the default) this module prevents the unloading of
core modules such as m_privmsg.