Until now, the security-policy-implementation directive had no effect.

When Implementation.py set the default policy, it set the
_implementation_set flag, preventing further changes.  Also,
Zope.Startup.run.configure() was not applying the security options.

lib/python/AccessControl/Implementation.py

@@ -96,3 +96,6 @@ _policy_names = {
 
 # start with the default, mostly because we need something for the tests
 setImplementation("C")
+
+# allow the implementation to change from the default
+_implementation_set = 0

lib/python/Zope/Startup/run.py

@@ -23,9 +23,11 @@ def configure(configfile):
     Zope before attempting to do 'app = Zope.app(). Should be used as
     follows:  from Zope.Startup.run import configure;
     configure('/path/to/configfile'); import Zope; app = Zope.app() """
-    from Zope.Startup import dropPrivileges
+    from Zope.Startup import ZopeStarter
     opts = _setconfig(configfile)
-    dropPrivileges(opts.configroot)
+    starter = ZopeStarter(opts.configroot)
+    starter.setupSecurityOptions()
+    starter.dropPrivileges()
 
 def _setconfig(configfile=None):
     """ Configure a Zope instance based on ZopeOptions.  Optionally