SecuritySystem.runAsAdmin and doAction should NOT take detached objects.

[jamoore]

Currently it's possible for SecuritySystem API consumers to mistakenly pass a detached (untrusted) entity into the runAsAdmin() or doAction() methods. This could violate much of the security system.

[jmoore]

r1005 makes it much more difficult to exploit this.

runAsAdmin can no longer use merge() meaning that the state of detached objects cannot be sent directly to the db. doAction will no longer accept detached entities whatsoever. (A similar approach for runAsAdmin would have been more safe, but is not possible.)

However, it is still possible that a service provider forgets to untaint objects. This is especially important for IAdmin. All methods must reload the entities from the DB. In fact, a @Untaint annotation would possibly be sensible (see #399).