After wrestling all week with the update for SF, I finally posted my application code to the server (click-once deployment). Users today are telling me that they have access to everything in my secured application...all menus and all forms. RBS does not seem to be engaged. Not good.