Thanks ghudson :)
This is a very important point, although I have always done that, exactly for that reason, for all my db's.
After keeping this on the backburner over night, I seem to have concluded that option 2 is the only alternative that does not by default invalidate the security. I'll...