backport (sh002i): restrict PG access to ImageGenerator object using RestrictedClosureClass (prevents problem code from monkeying with paths, viewing passwords, calling methods other than add() and other bad stuff)
Changed paths: