Comment 7 for bug 1415835

Note bug 1175464, that's for not adding the default security group to the neutron request unless the user specifies it, which is probably the more correct thing to do.

There is also an old abandoned change from arosen for that:

https://review.openstack.org/#/c/59578/