EJBCLIENT-104: run tests with security manager and provide fixes

https://issues.jboss.org/browse/EJBCLIENT-104
Stuart already fixed the main issue. The PR contains a full set of fixes and tests.
Why is this needed?  Classes should always have permission to create updaters on themselves as part of the special permission check that ARFU does.