bug.  Before the fix, ZopeSecurityPolicy saw the aq_base global and thought
the module object was wrapped, leading to unexpected behavior.