Ported "security" branch changes to new no-clj master.
TODO: resolve incubator version conflict.