avoid using AbstractCustomSecurityManager.implies in tests, since it is an information leak

Will be replaced soon as part of #5
refactor parent security manager to push protection domains to subclasses, instead of letting them pull

This closes #5
remove test permission that we don't need
add Classycle dependency verification