Fix bugs we missed in the last commit.

Policy Enforcer should not remove projects when setting security project.
Also fixes an undefined variable that happened in certain circumstances.

Change-Id: I41b6afdbc470791b6343bee3a0f0729963243795