Comment 2 for bug 1215133

The #1 suggestion from Jamie sounds reasonable and doable. Replacing the _ with - in the security manifest file's name is not a big deal. The only twist is that I need to make sure that when reading up the security manifest for a project what has _ in its name the right manifest file is searched for.