Merge "Clean up legacy security code" into nyc-dev