security docs update

There's a comment on the impersonating a user safely documentation page that says it needs to be updated. I'll admit I haven't tried this out and am unsure. Can anyone say whether this is the right way to do it?

It's probably worth doing a general review of all the security docs pages on a regular basis.

Some top level pages that people can review:
* Writing secure code
* Secure Configuration

We should review those top level pages and the sub-pages.