WL-3453 Don't allow sysadmin to bypass security checks.

Doing good tests requires too much refactoring so not including that work.
Is there any other way of doing this?  Empty catch blocks to control program flow...not ideal practice.  Bit of a rewrite probably?  That said, there are lots of examples of this so...