Move closure allocation closer to where it is used.
Needed for arc4random() and uin64_t.
The goal is to make it harder for someone to have a fake policy checker. This will not stop a determined adversary since the secret is present in the address space of the running process.