Having (laboriously) implemented IInternetSecurityManager in response to
WebBrowser.WebBrowserSite.IServiceProvider.QueryService, I now find that (a)
only GetSecurityID() and MapUrlToZone() get called, and (b) nothing they
return does anything useful. Return bad stuff and the WebBrowser control can
no longer navigate anywhere. Return anything valid and what you actually
return seems to be totally ignored.

In particular, ProcessUrlAction() is not called. It's like the real security
is happening somewhere else entirely.

So I'm doing something wrong. Any suggestions or sample code appreciated.
It's a bit long to post here.

DavidB