When Implementation.py set the default policy, it set the
_implementation_set flag, preventing further changes.  Also,
Zope.Startup.run.configure() was not applying the security options.

Python 2.3.3 doesn't need to import the types module here anymore

xmlrpclib in Python 2.3+ includes support for nil values and basic auth, so
Zope no longer needs to provide its own version.

  - Don't use bare 'eval' to check filtered set membershp (merge from
    2.6 / 2.7 audit).