Maybe merge all the groovy securing code into one place?  It feels funky to have the default receiver whitelist here but method blacklist above.