[SECURITY-87]

After talking to Jesse, he's OK with me bringing it back to public so
long as we don't allow other programmatic dependencies to it.

The intention of leaving them mutable is to allow admins to play with
this in the groovy script during the initialization and at runtime.

Groovy currently ignores the private access modifier anyway, but that is
considered as a bug in the upstream
(https://jira.codehaus.org/browse/GROOVY-3010)