Who Can Read on Edit Space doesn't affect Instances!!!

(Bug, Investigate , Priority: High, Test Status: No automated tests yet , Reported By Justin du Coeur, )
Security
Summary: Go into Edit Space. Set the Who Can Read to "Members". The Space Root is now hidden -- but if you happen to have internal URLs, they are Public!!!
This is beyond Critical -- we need to fix it ASAP.