Forget all the internal security stuff
Wrote up a simple security manager who will authorize things given an action, context, and actor
The default manager authorizes anything