Why not call "onSecurityError" from the RPC object in webinos.servicedisco.js here directly, instead of calling the API with handleRequest?

If the answer is to let the API implementation (servicedisco in this case) decide how to handle a request denied by policy, then we should probably think of a better way to annotate policy results in RPC requests instead of "params[3] = true".