change detection of system classes to be based on the presence of AllPermission

This is more flexible, and probably more reliable,
than detecting classloaders and package prefixes.