bandaid for #493

needs to be looked over by mouse; the problem with sec owners not removed from the list is solved here, we keep a settings artifact "secowners~" but access and exceptions are added and cleared correctly