SecurityClassLoader and URLClassLoader have unnecessary security checks.

protected SecureClassLoader() {
    super();
    // this is to make the stack depth consistent with 1.1
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkCreateClassLoader();
    }
    initialized = true;
}

1.1 security managers are no longer supported (see JDK-8186535). The permission check is done by the super class, ClassLoader. The initialized flag and associated code can also be removed -- this was only necessary before JDK 6 (see JSCG 4-5 for more info).