- remove ability to call abstract security administrator 
  - rename, make abstract methods protected
  - wrap, calling private
  - synchronize wrap where appropriate (long call may affect state)