make helper privileged regardless of caller since it is private, and clean up tests

- consult security manager on demand, instead of restricting Surefire
- make log mode per-instance, and add testing for it
- refactor checkPermission to assist testing of custom call stacks
- add test for the security bypass