Fix bug 1093784: Remove locale URL exemption from security pages.

I can't see any issue this would cause. It fixes the bug because the page was being cached
without varying on locale since the locale wasn't in the URL. However, bedrock was still making a guess
on the best locale for the Accept-Language header of the user that hit the non-cached page, which made
the URL for tabzilla use that locale. Subsequent visitors would get the cached page with whichever tabzilla
locale the first user got. There doesn't seem to be a reason to avoid the locale in the URL for /security
other than it'll likely never be localized.