Fair enough breaking out the security-specific features.  I got the impression from Andrew that we wanted to disable the HTTP listener when security is enabled.  I'll double check.  The search/replace is useful since it's idempotent.  Maybe that is less important for testing, however.