Security Enhancements

This was pushed on dev and looks OK. @jgmize r?
I call `service` not directly `nginx` to reload so `-s` is not needed.