remove test permission that we no longer need
update Maven group ID
create singleton security manager in constructor.

Keeps PMD happier, and we don't need to construct a new one each time.
broaden collection type and use Set instead of List since it is more appropriate.