got new security model to work for the (basic) 2 ciks I was using for testing; more testing required to actually trigger the more complex logic.  I suspect this will require quite a bit of work, but we have something in place, which is good