WEB-5081 - SecurityViolation comments

Nothing's fixed in this pass (too much work), but the comments will
guide future changes.