wait ... why the negation ?  I thought you were testing that you *do* get exception !
And, if you're going to negate it, why not make it more visible: <code>
    "ok" not => "security_exception"; 
</code> ?