Merge "veyron/services/mgmt/device: Add persistent arguments"
diff --git a/lib/modules/core/core_test.go b/lib/modules/core/core_test.go
index 15a7c6a..a0e03e8 100644
--- a/lib/modules/core/core_test.go
+++ b/lib/modules/core/core_test.go
@@ -10,7 +10,6 @@
 	"testing"
 	"time"
 
-	"v.io/core/veyron2"
 	"v.io/core/veyron2/vlog"
 
 	"v.io/core/veyron/lib/expect"
@@ -38,7 +37,7 @@
 // TODO(cnicolaou): add test for proxyd
 
 func newShell(t *testing.T) (*modules.Shell, func()) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 
 	sh, err := modules.NewShell(ctx, nil)
 	if err != nil {
diff --git a/lib/modules/examples_test.go b/lib/modules/examples_test.go
index 2784a03..cb97b64 100644
--- a/lib/modules/examples_test.go
+++ b/lib/modules/examples_test.go
@@ -6,7 +6,7 @@
 	"os"
 
 	"v.io/core/veyron/lib/modules"
-	"v.io/core/veyron2"
+	"v.io/core/veyron/lib/testutil"
 )
 
 func init() {
@@ -21,7 +21,7 @@
 }
 
 func ExampleDispatch() {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	if modules.IsModulesProcess() {
 		// Child process. Dispatch will invoke the 'echo' command
@@ -42,7 +42,7 @@
 }
 
 func ExampleDispatchAndExit() {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	// DispatchAndExit will call os.Exit(0) when executed within the child.
 	modules.DispatchAndExit()
diff --git a/lib/modules/modules_internal_test.go b/lib/modules/modules_internal_test.go
index d3f9328..393991b 100644
--- a/lib/modules/modules_internal_test.go
+++ b/lib/modules/modules_internal_test.go
@@ -7,9 +7,8 @@
 	"runtime"
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
-
-	"v.io/core/veyron2"
 )
 
 func Echo(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
@@ -30,7 +29,8 @@
 }
 
 func TestState(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
+
 	defer shutdown()
 
 	sh, err := NewShell(ctx, nil)
diff --git a/lib/modules/modules_test.go b/lib/modules/modules_test.go
index b92a696..277fb2f 100644
--- a/lib/modules/modules_test.go
+++ b/lib/modules/modules_test.go
@@ -53,7 +53,7 @@
 }
 
 func PrintBlessing(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	blessing := veyron2.GetPrincipal(ctx).BlessingStore().Default()
@@ -154,7 +154,7 @@
 }
 
 func TestChild(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -168,7 +168,7 @@
 }
 
 func TestAgent(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -193,7 +193,7 @@
 }
 
 func TestCustomPrincipal(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	p := security.NewPrincipal("myshell")
@@ -228,7 +228,7 @@
 }
 
 func TestChildNoRegistration(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -246,7 +246,7 @@
 }
 
 func TestFunction(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -260,7 +260,7 @@
 }
 
 func TestErrorChild(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -303,7 +303,7 @@
 }
 
 func TestShutdownSubprocess(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -318,7 +318,7 @@
 // forever if a child does not die upon closing stdin; but instead times out and
 // returns an appropriate error.
 func TestShutdownSubprocessIgnoresStdin(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -346,7 +346,7 @@
 // implementation inappropriately sets stdout to the file that is to be closed
 // in Wait.
 func TestStdoutRace(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -381,7 +381,7 @@
 }
 
 func TestShutdownFunction(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -393,7 +393,7 @@
 }
 
 func TestErrorFunc(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -420,7 +420,7 @@
 }
 
 func TestEnvelope(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -475,7 +475,7 @@
 }
 
 func TestEnvMerge(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index af499a8..69c47fd 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -54,7 +54,7 @@
 }
 
 func program(stdin io.Reader, stdout io.Writer, signals ...os.Signal) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 
 	closeStopLoop := make(chan struct{})
 	go stopLoop(veyron2.GetAppCycle(ctx).Stop, stdin, closeStopLoop)
@@ -81,7 +81,7 @@
 }
 
 func handleDefaultsIgnoreChan(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	closeStopLoop := make(chan struct{})
@@ -131,7 +131,7 @@
 // TestCleanShutdownSignal verifies that sending a signal to a child that
 // handles it by default causes the child to shut down cleanly.
 func TestCleanShutdownSignal(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -147,7 +147,7 @@
 // TestCleanShutdownStop verifies that sending a stop comamnd to a child that
 // handles stop commands by default causes the child to shut down cleanly.
 func TestCleanShutdownStop(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -164,7 +164,7 @@
 // that handles stop command as part of a custom set of signals handled, causes
 // the child to shut down cleanly.
 func TestCleanShutdownStopCustom(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustomWithStop")
@@ -188,7 +188,7 @@
 // TestStopNoHandler verifies that sending a stop command to a child that does
 // not handle stop commands causes the child to exit immediately.
 func TestStopNoHandler(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustom")
@@ -202,7 +202,7 @@
 // that handles these signals by default causes the child to exit immediately
 // upon receiving the second signal.
 func TestDoubleSignal(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -220,7 +220,7 @@
 // to a child that handles these by default causes the child to exit immediately
 // upon receiving the stop command.
 func TestSignalAndStop(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -237,7 +237,7 @@
 // that handles stop commands by default causes the child to exit immediately
 // upon receiving the second stop command.
 func TestDoubleStop(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -252,7 +252,7 @@
 // TestSendUnhandledSignal verifies that sending a signal that the child does
 // not handle causes the child to exit as per the signal being sent.
 func TestSendUnhandledSignal(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -268,7 +268,7 @@
 // process to exit (ensures that there is no dependency in ShutdownOnSignals
 // on having a goroutine read from the returned channel).
 func TestDoubleSignalIgnoreChan(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaultsIgnoreChan")
@@ -286,7 +286,7 @@
 // TestHandlerCustomSignal verifies that sending a non-default signal to a
 // server that listens for that signal causes the server to shut down cleanly.
 func TestHandlerCustomSignal(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustom")
@@ -303,7 +303,7 @@
 // to a server that listens for that signal causes the server to shut down
 // cleanly, even when a STOP signal is also among the handled signals.
 func TestHandlerCustomSignalWithStop(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	for _, signal := range []syscall.Signal{syscall.SIGABRT, syscall.SIGHUP} {
@@ -364,7 +364,7 @@
 
 // TestCleanRemoteShutdown verifies that remote shutdown works correctly.
 func TestCleanRemoteShutdown(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
diff --git a/lib/testutil/init.go b/lib/testutil/init.go
index dbc7a18..4e328b3 100644
--- a/lib/testutil/init.go
+++ b/lib/testutil/init.go
@@ -15,10 +15,17 @@
 	"sync"
 	"time"
 
+	tsecurity "v.io/core/veyron/lib/testutil/security"
+
+	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/vlog"
 )
 
-const SeedEnv = "VEYRON_RNG_SEED"
+const (
+	SeedEnv      = "VEYRON_RNG_SEED"
+	TestBlessing = "test-blessing"
+)
 
 // Random is a concurrent-access friendly source of randomness.
 type Random struct {
@@ -94,3 +101,18 @@
 	os.Setenv("VEYRON_CREDENTIALS", "")
 	os.Setenv("VEYRON_AGENT_FD", "")
 }
+
+// InitForTest initializes a new context.T and sets a freshly created principal
+// (with a single self-signed blessing) on it. The principal setting step is skipped
+// if this function is invoked from a process run using the modules package.
+func InitForTest() (*context.T, veyron2.Shutdown) {
+	ctx, shutdown := veyron2.Init()
+	if len(os.Getenv("VEYRON_SHELL_HELPER_PROCESS_ENTRY_POINT")) != 0 {
+		return ctx, shutdown
+	}
+	var err error
+	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal(TestBlessing)); err != nil {
+		panic(err)
+	}
+	return ctx, shutdown
+}
diff --git a/runtimes/google/ipc/benchmark/benchmark_test.go b/runtimes/google/ipc/benchmark/benchmark_test.go
index f0a00bc..7bd0db8 100644
--- a/runtimes/google/ipc/benchmark/benchmark_test.go
+++ b/runtimes/google/ipc/benchmark/benchmark_test.go
@@ -4,6 +4,7 @@
 	"os"
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	"v.io/core/veyron/lib/testutil/benchmark"
 	tsecurity "v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
@@ -104,7 +105,7 @@
 	// We do not use defer here since this program will exit at the end of
 	// this function through os.Exit().
 	var shutdown veyron2.Shutdown
-	ctx, shutdown = veyron2.Init()
+	ctx, shutdown = testutil.InitForTest()
 
 	var err error
 	ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
diff --git a/runtimes/google/ipc/benchmark/glob/glob_test.go b/runtimes/google/ipc/benchmark/glob/glob_test.go
index e79a9fe..675ed30 100644
--- a/runtimes/google/ipc/benchmark/glob/glob_test.go
+++ b/runtimes/google/ipc/benchmark/glob/glob_test.go
@@ -10,7 +10,7 @@
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/security"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -155,12 +155,8 @@
 }
 
 func RunBenchmarkGlob(b *testing.B, obj interface{}) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
-	if err != nil {
-		panic(err)
-	}
 
 	addr, stop, err := startServer(b, ctx, obj)
 	if err != nil {
diff --git a/runtimes/google/ipc/client.go b/runtimes/google/ipc/client.go
index c0d41df..5f53bc8 100644
--- a/runtimes/google/ipc/client.go
+++ b/runtimes/google/ipc/client.go
@@ -296,15 +296,6 @@
 	return
 }
 
-func allowCancel(opts []ipc.CallOpt) bool {
-	for _, o := range opts {
-		if _, ok := o.(inaming.NoCancel); ok {
-			return false
-		}
-	}
-	return true
-}
-
 func mkDischargeImpetus(serverBlessings []string, method string, args []interface{}) security.DischargeImpetus {
 	var impetus security.DischargeImpetus
 	if len(serverBlessings) > 0 {
@@ -500,10 +491,7 @@
 				continue
 			}
 
-			var doneChan <-chan struct{}
-			if allowCancel(opts) {
-				doneChan = ctx.Done()
-			}
+			doneChan := ctx.Done()
 			r.flow.SetDeadline(doneChan)
 
 			var (
diff --git a/runtimes/google/ipc/client_test.go b/runtimes/google/ipc/client_test.go
index 22d61a0..ad6eca7 100644
--- a/runtimes/google/ipc/client_test.go
+++ b/runtimes/google/ipc/client_test.go
@@ -20,6 +20,7 @@
 	"v.io/core/veyron/lib/flags/consts"
 	"v.io/core/veyron/lib/modules"
 	"v.io/core/veyron/lib/modules/core"
+	"v.io/core/veyron/lib/testutil"
 	tsecurity "v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
 	inaming "v.io/core/veyron/runtimes/google/naming"
@@ -30,12 +31,7 @@
 }
 
 func newCtx() (*context.T, veyron2.Shutdown) {
-	ctx, shutdown := veyron2.Init()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
-	if err != nil {
-		panic(err)
-	}
-
+	ctx, shutdown := testutil.InitForTest()
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 	return ctx, shutdown
 }
@@ -172,7 +168,7 @@
 }
 
 func childPing(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -271,7 +267,7 @@
 }
 
 func TestAccessDenied(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	ctx1, err := veyron2.SetPrincipal(rootCtx, tsecurity.NewPrincipal("test-blessing"))
@@ -495,7 +491,7 @@
 // connection to the server if the server dies and comes back (on the same
 // endpoint).
 func TestReconnect(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	principal := tsecurity.NewPrincipal("client")
diff --git a/runtimes/google/ipc/full_test.go b/runtimes/google/ipc/full_test.go
index f9859b2..2db17e4 100644
--- a/runtimes/google/ipc/full_test.go
+++ b/runtimes/google/ipc/full_test.go
@@ -88,7 +88,7 @@
 }
 
 func testContextWithoutDeadline() *context.T {
-	var ctx *context.T
+	ctx, _ := context.RootContext()
 	ctx, err := ivtrace.Init(ctx, flags.VtraceFlags{})
 	if err != nil {
 		panic(err)
diff --git a/runtimes/google/ipc/glob_test.go b/runtimes/google/ipc/glob_test.go
index 926bbe6..ae9b4e6 100644
--- a/runtimes/google/ipc/glob_test.go
+++ b/runtimes/google/ipc/glob_test.go
@@ -14,7 +14,6 @@
 
 	"v.io/core/veyron/lib/glob"
 	"v.io/core/veyron/lib/testutil"
-	tsecurity "v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -35,12 +34,8 @@
 }
 
 func TestGlob(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
-	if err != nil {
-		t.Fatal(err)
-	}
 
 	namespace := []string{
 		"a/b/c1/d1",
diff --git a/runtimes/google/ipc/resolve_test.go b/runtimes/google/ipc/resolve_test.go
index 1b22f21..ece505c 100644
--- a/runtimes/google/ipc/resolve_test.go
+++ b/runtimes/google/ipc/resolve_test.go
@@ -11,7 +11,7 @@
 	"v.io/core/veyron/lib/expect"
 	"v.io/core/veyron/lib/modules"
 	"v.io/core/veyron/lib/modules/core"
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	iipc "v.io/core/veyron/runtimes/google/ipc"
 	inaming "v.io/core/veyron/runtimes/google/naming"
 )
@@ -34,11 +34,8 @@
 	defer sh.Cleanup(nil, nil)
 	root := startMT(t, sh)
 
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
 
 	ns := veyron2.GetNamespace(ctx)
 	ns.SetRoots(root)
diff --git a/runtimes/google/ipc/server.go b/runtimes/google/ipc/server.go
index 936402c..7fc7546 100644
--- a/runtimes/google/ipc/server.go
+++ b/runtimes/google/ipc/server.go
@@ -40,6 +40,7 @@
 	sync.Mutex
 	state        serverState          // track state of the server.
 	ctx          *context.T           // context used by the server to make internal RPCs.
+	cancel       context.CancelFunc   // function to cancel the above context.
 	streamMgr    stream.Manager       // stream manager to listen for new flows.
 	publisher    publisher.Publisher  // publisher to publish mounttable mounts.
 	listenerOpts []stream.ListenerOpt // listener opts for Listen.
@@ -147,10 +148,12 @@
 func (ReservedNameDispatcher) IPCServerOpt() {}
 
 func InternalNewServer(ctx *context.T, streamMgr stream.Manager, ns naming.Namespace, client ipc.Client, opts ...ipc.ServerOpt) (ipc.Server, error) {
+	ctx, cancel := context.WithRootCancel(ctx)
 	ctx, _ = vtrace.SetNewSpan(ctx, "NewServer")
 	statsPrefix := naming.Join("ipc", "server", "routing-id", streamMgr.RoutingID().String())
 	s := &server{
 		ctx:           ctx,
+		cancel:        cancel,
 		streamMgr:     streamMgr,
 		publisher:     publisher.New(ctx, ns, publishPeriod),
 		listeners:     make(map[stream.Listener]struct{}),
@@ -842,6 +845,7 @@
 		return verror.Make(verror.Internal, s.ctx, firstErr)
 	}
 	s.state = stopped
+	s.cancel()
 	return nil
 }
 
diff --git a/runtimes/google/ipc/signature_test.go b/runtimes/google/ipc/signature_test.go
index cba1d30..bd54d06 100644
--- a/runtimes/google/ipc/signature_test.go
+++ b/runtimes/google/ipc/signature_test.go
@@ -14,7 +14,6 @@
 	"v.io/core/veyron2/vdl/vdlroot/src/signature"
 
 	"v.io/core/veyron/lib/testutil"
-	tsecurity "v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -59,12 +58,8 @@
 }
 
 func TestMethodSignature(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
-	if err != nil {
-		t.Fatal(err)
-	}
 	ep, stop, err := startSigServer(ctx, sigImpl{})
 	if err != nil {
 		t.Fatalf("startSigServer: %v", err)
@@ -109,12 +104,8 @@
 }
 
 func TestSignature(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing"))
-	if err != nil {
-		t.Fatal(err)
-	}
 	ep, stop, err := startSigServer(ctx, sigImpl{})
 	if err != nil {
 		t.Fatalf("startSigServer: %v", err)
diff --git a/runtimes/google/lib/publisher/publisher_test.go b/runtimes/google/lib/publisher/publisher_test.go
index 1fe0992..a70d1e2 100644
--- a/runtimes/google/lib/publisher/publisher_test.go
+++ b/runtimes/google/lib/publisher/publisher_test.go
@@ -23,7 +23,7 @@
 }
 
 func testContext() *context.T {
-	var ctx *context.T
+	ctx, _ := context.RootContext()
 	ctx, err := ivtrace.Init(ctx, flags.VtraceFlags{})
 	if err != nil {
 		panic(err)
diff --git a/runtimes/google/naming/namespace/all_test.go b/runtimes/google/naming/namespace/all_test.go
index 855225e..170cfac 100644
--- a/runtimes/google/naming/namespace/all_test.go
+++ b/runtimes/google/naming/namespace/all_test.go
@@ -29,17 +29,14 @@
 }
 
 func createContexts(t *testing.T) (sc, c *context.T, cleanup func()) {
-	ctx, shutdown := veyron2.Init()
-
+	ctx, shutdown := testutil.InitForTest()
 	var err error
 	if sc, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
 		t.Fatal(err)
 	}
-
 	if c, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
 		t.Fatal(err)
 	}
-
 	return sc, c, shutdown
 }
 
diff --git a/runtimes/google/naming/namespace/mount.go b/runtimes/google/naming/namespace/mount.go
index 7b7ce3a..0cab494 100644
--- a/runtimes/google/naming/namespace/mount.go
+++ b/runtimes/google/naming/namespace/mount.go
@@ -37,7 +37,7 @@
 func unmountFromMountTable(ctx *context.T, client ipc.Client, name, server string, id string) (s status) {
 	s.id = id
 	ctx, _ = context.WithTimeout(ctx, callTimeout)
-	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{server}, options.NoResolve{}, inaming.NoCancel{})
+	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{server}, options.NoResolve{})
 	s.err = err
 	if err != nil {
 		return
@@ -139,7 +139,7 @@
 	f := func(context *context.T, mt, id string) status {
 		return unmountFromMountTable(ctx, client, mt, server, id)
 	}
-	err := ns.dispatch(ctx, name, f, inaming.NoCancel{})
+	err := ns.dispatch(ctx, name, f)
 	vlog.VI(1).Infof("Unmount(%s, %s) -> %v", name, server, err)
 	return err
 }
diff --git a/runtimes/google/naming/nocancel.go b/runtimes/google/naming/nocancel.go
deleted file mode 100644
index 85e1658..0000000
--- a/runtimes/google/naming/nocancel.go
+++ /dev/null
@@ -1,11 +0,0 @@
-package naming
-
-// NoCancel is an option passed to a resolve or an IPC call that
-// instructs it to ignore cancellation for that call.
-// This is used to allow servers to unmount even after their context
-// has been cancelled.
-// TODO(mattr): Find a better mechanism for this.
-type NoCancel struct{}
-
-func (NoCancel) IPCCallOpt()   {}
-func (NoCancel) NSResolveOpt() {}
diff --git a/runtimes/google/rt/ipc_test.go b/runtimes/google/rt/ipc_test.go
index 95d73be..3d72538 100644
--- a/runtimes/google/rt/ipc_test.go
+++ b/runtimes/google/rt/ipc_test.go
@@ -109,7 +109,7 @@
 }
 
 func TestClientServerBlessings(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	var (
@@ -199,7 +199,7 @@
 }
 
 func TestServerDischarges(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	var (
diff --git a/runtimes/google/rt/mgmt_test.go b/runtimes/google/rt/mgmt_test.go
index 572de13..41271ef 100644
--- a/runtimes/google/rt/mgmt_test.go
+++ b/runtimes/google/rt/mgmt_test.go
@@ -14,13 +14,11 @@
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/mgmt"
 	"v.io/core/veyron2/naming"
-	"v.io/core/veyron2/security"
 	"v.io/core/veyron2/services/mgmt/appcycle"
 
 	"v.io/core/veyron/lib/expect"
 	"v.io/core/veyron/lib/modules"
 	"v.io/core/veyron/lib/testutil"
-	tsecurity "v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
 	vflag "v.io/core/veyron/security/flag"
 	"v.io/core/veyron/services/mgmt/device"
@@ -42,12 +40,8 @@
 // TestBasic verifies that the basic plumbing works: LocalStop calls result in
 // stop messages being sent on the channel passed to WaitForStop.
 func TestBasic(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
 
 	m := veyron2.GetAppCycle(ctx)
 	ch := make(chan string, 1)
@@ -68,12 +62,8 @@
 // TestMultipleWaiters verifies that the plumbing works with more than one
 // registered wait channel.
 func TestMultipleWaiters(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
 
 	m := veyron2.GetAppCycle(ctx)
 	ch1 := make(chan string, 1)
@@ -95,12 +85,8 @@
 // channel is not being drained: once the channel's buffer fills up, future
 // Stops become no-ops.
 func TestMultipleStops(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
 
 	m := veyron2.GetAppCycle(ctx)
 	ch := make(chan string, 1)
@@ -119,7 +105,7 @@
 }
 
 func noWaiters(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	m := veyron2.GetAppCycle(ctx)
@@ -150,7 +136,7 @@
 }
 
 func forceStop(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	m := veyron2.GetAppCycle(ctx)
@@ -200,11 +186,7 @@
 // TestProgress verifies that the ticker update/track logic works for a single
 // tracker.
 func TestProgress(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
+	ctx, shutdown := testutil.InitForTest()
 
 	m := veyron2.GetAppCycle(ctx)
 	m.AdvanceGoal(50)
@@ -236,11 +218,7 @@
 // works for more than one tracker.  It also ensures that the runtime doesn't
 // block when the tracker channels are full.
 func TestProgressMultipleTrackers(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		t.Fatal(err)
-	}
+	ctx, shutdown := testutil.InitForTest()
 
 	m := veyron2.GetAppCycle(ctx)
 	// ch1 is 1-buffered, ch2 is 2-buffered.
@@ -275,7 +253,7 @@
 }
 
 func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	m := veyron2.GetAppCycle(ctx)
@@ -319,12 +297,8 @@
 	return server, eps[0].Name(), ch
 }
 
-func setupRemoteAppCycleMgr(t *testing.T, p security.Principal) (*context.T, modules.Handle, appcycle.AppCycleClientMethods, func()) {
-	ctx, shutdown := veyron2.Init()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, p); err != nil {
-		t.Fatal(err)
-	}
+func setupRemoteAppCycleMgr(t *testing.T) (*context.T, modules.Handle, appcycle.AppCycleClientMethods, func()) {
+	ctx, shutdown := testutil.InitForTest()
 
 	configServer, configServiceName, ch := createConfigServer(t, ctx)
 	sh, err := modules.NewShell(ctx, veyron2.GetPrincipal(ctx))
@@ -355,7 +329,7 @@
 // TestRemoteForceStop verifies that the child process exits when sending it
 // a remote ForceStop rpc.
 func TestRemoteForceStop(t *testing.T) {
-	ctx, h, appCycle, cleanup := setupRemoteAppCycleMgr(t, tsecurity.NewPrincipal("test-blessing"))
+	ctx, h, appCycle, cleanup := setupRemoteAppCycleMgr(t)
 	defer cleanup()
 	if err := appCycle.ForceStop(ctx); err == nil || !strings.Contains(err.Error(), "EOF") {
 		t.Fatalf("Expected EOF error, got %v instead", err)
@@ -372,7 +346,7 @@
 // TestRemoteStop verifies that the child shuts down cleanly when sending it
 // a remote Stop rpc.
 func TestRemoteStop(t *testing.T) {
-	ctx, h, appCycle, cleanup := setupRemoteAppCycleMgr(t, tsecurity.NewPrincipal("test-blessing"))
+	ctx, h, appCycle, cleanup := setupRemoteAppCycleMgr(t)
 	defer cleanup()
 	stream, err := appCycle.Stop(ctx)
 	if err != nil {
diff --git a/runtimes/google/rt/rt_test.go b/runtimes/google/rt/rt_test.go
index a4e473d..1172939 100644
--- a/runtimes/google/rt/rt_test.go
+++ b/runtimes/google/rt/rt_test.go
@@ -59,7 +59,7 @@
 }
 
 func child(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	_, shutdown := veyron2.Init()
+	_, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	logger := vlog.Log
@@ -125,7 +125,7 @@
 }
 
 func principal(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	p := veyron2.GetPrincipal(ctx)
@@ -139,7 +139,7 @@
 // Runner runs a principal as a subprocess and reports back with its
 // own security info and it's childs.
 func runner(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	p := veyron2.GetPrincipal(ctx)
diff --git a/runtimes/google/rt/runtime.go b/runtimes/google/rt/runtime.go
index fceb78e..3614268 100644
--- a/runtimes/google/rt/runtime.go
+++ b/runtimes/google/rt/runtime.go
@@ -21,6 +21,7 @@
 	"v.io/core/veyron2/vtrace"
 
 	"v.io/core/veyron/lib/flags"
+	"v.io/core/veyron/lib/stats"
 	_ "v.io/core/veyron/lib/stats/sysstats"
 	iipc "v.io/core/veyron/runtimes/google/ipc"
 	imanager "v.io/core/veyron/runtimes/google/ipc/stream/manager"
@@ -60,7 +61,6 @@
 	opts       []ipc.ServerOpt
 }
 
-// TODO(mattr,suharshs): Decide if Options would be better than this.
 func Init(ctx *context.T, appCycle veyron2.AppCycle, protocols []string, listenSpec *ipc.ListenSpec, flags flags.RuntimeFlags,
 	reservedDispatcher ipc.Dispatcher, dispatcherOpts ...ipc.ServerOpt) (*Runtime, *context.T, veyron2.Shutdown, error) {
 	r := &Runtime{deps: dependency.NewGraph()}
@@ -139,7 +139,7 @@
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	ctx = context.WithValue(ctx, principalKey, principal)
+	ctx = r.setPrincipal(ctx, principal)
 
 	// Set up secure client.
 	ctx, _, err = r.SetNewClient(ctx)
@@ -149,9 +149,6 @@
 
 	ctx = r.SetBackgroundContext(ctx)
 
-	// TODO(suharshs,mattr): Go through the rt.Cleanup function and make sure everything
-	// gets cleaned up.
-
 	return r, ctx, r.shutdown, nil
 }
 
@@ -281,16 +278,20 @@
 	return cl
 }
 
+func (*Runtime) setPrincipal(ctx *context.T, principal security.Principal) *context.T {
+	// We uniquely identity a principal with "security/principal/<publicKey>"
+	principalName := "security/principal/" + principal.PublicKey().String()
+	stats.NewStringFunc(principalName+"/blessingstore", principal.BlessingStore().DebugString)
+	stats.NewStringFunc(principalName+"/blessingroots", principal.Roots().DebugString)
+	return context.WithValue(ctx, principalKey, principal)
+}
+
 func (r *Runtime) SetPrincipal(ctx *context.T, principal security.Principal) (*context.T, error) {
 	var err error
 	newctx := ctx
 
-	newctx = context.WithValue(newctx, principalKey, principal)
+	newctx = r.setPrincipal(ctx, principal)
 
-	// TODO(mattr, suharshs): The stream manager holds a cache of vifs
-	// which were negotiated with the principal, so we replace it here when the
-	// principal changes.  However we should negotiate the vif with a
-	// random principal and then we needn't replace this here.
 	if newctx, _, err = r.setNewStreamManager(newctx); err != nil {
 		return ctx, err
 	}
@@ -312,10 +313,6 @@
 func (r *Runtime) SetNewClient(ctx *context.T, opts ...ipc.ClientOpt) (*context.T, ipc.Client, error) {
 	otherOpts := append([]ipc.ClientOpt{}, opts...)
 
-	// TODO(mattr, suharshs):  Currently there are a lot of things that can come in as opts.
-	// Some of them will be removed as opts and simply be pulled from the context instead
-	// these are:
-	// stream.Manager, Namespace, LocalPrincipal, preferred protocols.
 	sm, _ := ctx.Value(streamManagerKey).(stream.Manager)
 	ns, _ := ctx.Value(namespaceKey).(naming.Namespace)
 	p, _ := ctx.Value(principalKey).(security.Principal)
@@ -341,9 +338,13 @@
 	return cl
 }
 
-func (*Runtime) setNewNamespace(ctx *context.T, roots ...string) (*context.T, naming.Namespace, error) {
+func (r *Runtime) setNewNamespace(ctx *context.T, roots ...string) (*context.T, naming.Namespace, error) {
 	ns, err := namespace.New(roots...)
-	// TODO(mattr): Copy cache settings.
+
+	if oldNS := r.GetNamespace(ctx); oldNS != nil {
+		ns.CacheCtl(oldNS.CacheCtl()...)
+	}
+
 	if err == nil {
 		ctx = context.WithValue(ctx, namespaceKey, ns)
 	}
diff --git a/runtimes/google/rt/runtime_test.go b/runtimes/google/rt/runtime_test.go
index 4f41e20..cb6b000 100644
--- a/runtimes/google/rt/runtime_test.go
+++ b/runtimes/google/rt/runtime_test.go
@@ -5,6 +5,7 @@
 
 	"v.io/core/veyron2"
 	"v.io/core/veyron2/context"
+	"v.io/core/veyron2/naming"
 
 	"v.io/core/veyron/lib/flags"
 	tsecurity "v.io/core/veyron/lib/testutil/security"
@@ -14,7 +15,7 @@
 
 // InitForTest creates a context for use in a test.
 func InitForTest(t *testing.T) (*rt.Runtime, *context.T, veyron2.Shutdown) {
-	ctx, cancel := context.WithCancel(nil)
+	ctx, cancel := context.RootContext()
 	r, ctx, shutdown, err := rt.Init(ctx, nil, nil, nil, flags.RuntimeFlags{}, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -104,6 +105,7 @@
 	defer shutdown()
 
 	orig := r.GetNamespace(ctx)
+	orig.CacheCtl(naming.DisableCache(true))
 
 	newroots := []string{"/newroot1", "/newroot2"}
 	c2, ns, err := r.SetNewNamespace(ctx, newroots...)
@@ -125,6 +127,13 @@
 			t.Errorf("root %s found in ns, but we expected: %v", root, newroots)
 		}
 	}
+	opts := ns.CacheCtl()
+	if len(opts) != 1 {
+		t.Fatalf("Expected one option for cache control, got %v", opts)
+	}
+	if disable, ok := opts[0].(naming.DisableCache); !ok || !bool(disable) {
+		t.Errorf("expected a disable(true) message got %#v", opts[0])
+	}
 }
 
 func TestBackgroundContext(t *testing.T) {
diff --git a/runtimes/google/rt/security.go b/runtimes/google/rt/security.go
index b4a3aef..f06f9ed 100644
--- a/runtimes/google/rt/security.go
+++ b/runtimes/google/rt/security.go
@@ -13,7 +13,6 @@
 	"v.io/core/veyron2/security"
 
 	"v.io/core/veyron/lib/exec"
-	"v.io/core/veyron/lib/stats"
 	vsecurity "v.io/core/veyron/security"
 	"v.io/core/veyron/security/agent"
 )
@@ -24,10 +23,6 @@
 		return nil, err
 	}
 
-	// TODO(suharshs,mattr): Move this code to SetNewPrincipal and determine what their string should be.
-	stats.NewString("security/principal/key").Set(principal.PublicKey().String())
-	stats.NewStringFunc("security/principal/blessingstore", principal.BlessingStore().DebugString)
-	stats.NewStringFunc("security/principal/blessingroots", principal.Roots().DebugString)
 	return principal, nil
 }
 
diff --git a/runtimes/google/rt/shutdown_servers_test.go b/runtimes/google/rt/shutdown_servers_test.go
index f841f31..0b27067 100644
--- a/runtimes/google/rt/shutdown_servers_test.go
+++ b/runtimes/google/rt/shutdown_servers_test.go
@@ -16,7 +16,7 @@
 
 	"v.io/core/veyron/lib/modules"
 	"v.io/core/veyron/lib/signals"
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -72,14 +72,10 @@
 // For a more typical server, see simpleServerProgram.
 func complexServerProgram(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	// Initialize the runtime.  This is boilerplate.
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	// shutdown is optional, but it's a good idea to clean up, especially
 	// since it takes care of flushing the logs before exiting.
 	defer shutdown()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		vlog.Fatal(err)
-	}
 
 	// This is part of the test setup -- we need a way to accept
 	// commands from the parent process to simulate Stop and
@@ -218,7 +214,7 @@
 // complexServerProgram.
 func simpleServerProgram(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	// Initialize the runtime.  This is boilerplate.
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	// Calling shutdown is optional, but it's a good idea to clean up, especially
 	// since it takes care of flushing the logs before exiting.
 	//
@@ -226,10 +222,6 @@
 	// avoid shutting down the runtime while it may still be in use), and to
 	// allow it to execute even if a panic occurs down the road.
 	defer shutdown()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		vlog.Fatal(err)
-	}
 
 	// This is part of the test setup -- we need a way to accept
 	// commands from the parent process to simulate Stop and
diff --git a/runtimes/google/rt/signal_test.go b/runtimes/google/rt/signal_test.go
index 9cf77af..5401a2b 100644
--- a/runtimes/google/rt/signal_test.go
+++ b/runtimes/google/rt/signal_test.go
@@ -9,10 +9,9 @@
 	"testing"
 	"time"
 
-	"v.io/core/veyron2"
-
 	"v.io/core/veyron/lib/expect"
 	"v.io/core/veyron/lib/modules"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -31,7 +30,7 @@
 }
 
 func withRuntime(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	_, shutdown := veyron2.Init()
+	_, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	simpleEchoProgram(stdin, stdout)
diff --git a/runtimes/google/testing/mocks/ipc/simple_client_test.go b/runtimes/google/testing/mocks/ipc/simple_client_test.go
index a4bd4f0..f14eb7d 100644
--- a/runtimes/google/testing/mocks/ipc/simple_client_test.go
+++ b/runtimes/google/testing/mocks/ipc/simple_client_test.go
@@ -7,11 +7,8 @@
 )
 
 func testContext() *context.T {
-	// The nil context is not directly usable, we need to create
-	// a context specially.
-	type key struct{}
-	var ctx *context.T
-	return context.WithValue(ctx, key{}, nil)
+	ctx, _ := context.RootContext()
+	return ctx
 }
 
 func TestSuccessfulCalls(t *testing.T) {
diff --git a/runtimes/google/vtrace/vtrace_test.go b/runtimes/google/vtrace/vtrace_test.go
index 323ef8c..ebf7266 100644
--- a/runtimes/google/vtrace/vtrace_test.go
+++ b/runtimes/google/vtrace/vtrace_test.go
@@ -14,6 +14,7 @@
 	"v.io/core/veyron2/vlog"
 	"v.io/core/veyron2/vtrace"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	iipc "v.io/core/veyron/runtimes/google/ipc"
 	"v.io/core/veyron/runtimes/google/ipc/stream/manager"
@@ -21,7 +22,7 @@
 )
 
 func TestNewFromContext(t *testing.T) {
-	c0, shutdown := veyron2.Init()
+	c0, shutdown := testutil.InitForTest()
 	defer shutdown()
 	c1, s1 := vtrace.SetNewSpan(c0, "s1")
 	c2, s2 := vtrace.SetNewSpan(c1, "s2")
@@ -232,7 +233,7 @@
 // TestCancellationPropagation tests that cancellation propogates along an
 // RPC call chain without user intervention.
 func TestTraceAcrossRPCs(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	ctx, span := vtrace.SetNewSpan(ctx, "")
 	vtrace.ForceCollect(ctx)
@@ -256,7 +257,7 @@
 // TestCancellationPropagationLateForce tests that cancellation propogates along an
 // RPC call chain when tracing is initiated by someone deep in the call chain.
 func TestTraceAcrossRPCsLateForce(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	ctx, span := vtrace.SetNewSpan(ctx, "")
 	span.Annotate("c0-begin")
diff --git a/security/agent/agent_test.go b/security/agent/agent_test.go
index 8b1f757..a6593f6 100644
--- a/security/agent/agent_test.go
+++ b/security/agent/agent_test.go
@@ -7,6 +7,7 @@
 	"reflect"
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/security/agent"
 	"v.io/core/veyron/security/agent/server"
@@ -48,7 +49,7 @@
 )
 
 func TestAgent(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	var (
diff --git a/security/agent/keymgr/keymgr_test.go b/security/agent/keymgr/keymgr_test.go
index b78c454..40ca1af 100644
--- a/security/agent/keymgr/keymgr_test.go
+++ b/security/agent/keymgr/keymgr_test.go
@@ -8,6 +8,7 @@
 	"syscall"
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/security/agent"
 	"v.io/core/veyron/security/agent/server"
@@ -39,7 +40,7 @@
 }
 
 func TestNoDeviceManager(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	agent, cleanup, err := createAgent(ctx, "")
@@ -71,7 +72,7 @@
 }
 
 func TestSigning(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	path, err := ioutil.TempDir("", "agent")
@@ -138,7 +139,7 @@
 }
 
 func TestInMemorySigning(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	path, err := ioutil.TempDir("", "agent")
diff --git a/security/agent/pingpong/main.go b/security/agent/pingpong/main.go
index 4b8c428..2db7acd 100644
--- a/security/agent/pingpong/main.go
+++ b/security/agent/pingpong/main.go
@@ -11,6 +11,7 @@
 	"v.io/core/veyron2/vlog"
 
 	"v.io/core/veyron/lib/signals"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -62,7 +63,7 @@
 func (allowEveryone) Authorize(security.Context) error { return nil }
 
 func main() {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	if *runServer {
diff --git a/security/agent/test_principal/main.go b/security/agent/test_principal/main.go
index b8dc549..036f30a 100644
--- a/security/agent/test_principal/main.go
+++ b/security/agent/test_principal/main.go
@@ -9,6 +9,7 @@
 	"reflect"
 	"runtime"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron2"
 	"v.io/core/veyron2/security"
@@ -23,10 +24,6 @@
 }
 
 func main() {
-	ctx, shutdown := veyron2.Init()
-	defer shutdown()
-	p := veyron2.GetPrincipal(ctx)
-
 	var errors []string
 	defer func() {
 		if len(errors) == 0 {
@@ -43,6 +40,11 @@
 		errors = append(errors, fmt.Sprintf("%v:%d: %v", file, line, fmt.Sprintf(format, args...)))
 	}
 
+	ctx, shutdown := testutil.InitForTest()
+	defer shutdown()
+
+	p := veyron2.GetPrincipal(ctx)
+
 	// BlessSelf
 	b, err := p.BlessSelf("batman")
 	if err != nil {
diff --git a/security/serialization/serialization_test.go b/security/serialization/serialization_test.go
index 67e9287..bda4c95 100644
--- a/security/serialization/serialization_test.go
+++ b/security/serialization/serialization_test.go
@@ -1,4 +1,4 @@
-package serialization
+package serialization_test
 
 import (
 	"bytes"
@@ -14,6 +14,7 @@
 	"testing"
 
 	"v.io/core/veyron/lib/testutil"
+	"v.io/core/veyron/security/serialization"
 
 	"v.io/core/veyron2/security"
 )
@@ -28,8 +29,8 @@
 	return nil
 }
 
-func signingWrite(d, s io.WriteCloser, signer Signer, writeList [][]byte, opts *Options) error {
-	swc, err := NewSigningWriteCloser(d, s, signer, opts)
+func signingWrite(d, s io.WriteCloser, signer serialization.Signer, writeList [][]byte, opts *serialization.Options) error {
+	swc, err := serialization.NewSigningWriteCloser(d, s, signer, opts)
 	if err != nil {
 		return fmt.Errorf("NewSigningWriteCloser failed: %s", err)
 	}
@@ -45,14 +46,14 @@
 }
 
 func verifyingRead(d, s io.Reader, key security.PublicKey) ([]byte, error) {
-	vr, err := NewVerifyingReader(d, s, key)
+	vr, err := serialization.NewVerifyingReader(d, s, key)
 	if err != nil {
 		return nil, fmt.Errorf("NewVerifyingReader failed: %s", err)
 	}
 	return ioutil.ReadAll(vr)
 }
 
-func newSigner() Signer {
+func newSigner() serialization.Signer {
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		panic(err)
@@ -77,12 +78,12 @@
 
 	testdata := []struct {
 		writeList [][]byte
-		opts      *Options
+		opts      *serialization.Options
 	}{
 		{[][]byte{testutil.RandomBytes(1)}, nil},
 		{[][]byte{testutil.RandomBytes(100)}, nil},
-		{[][]byte{testutil.RandomBytes(100)}, &Options{ChunkSizeBytes: 10}},
-		{[][]byte{testutil.RandomBytes(25), testutil.RandomBytes(15), testutil.RandomBytes(60), testutil.RandomBytes(5)}, &Options{ChunkSizeBytes: 7}},
+		{[][]byte{testutil.RandomBytes(100)}, &serialization.Options{ChunkSizeBytes: 10}},
+		{[][]byte{testutil.RandomBytes(25), testutil.RandomBytes(15), testutil.RandomBytes(60), testutil.RandomBytes(5)}, &serialization.Options{ChunkSizeBytes: 7}},
 	}
 	for _, test := range testdata {
 		d.Reset()
@@ -116,7 +117,7 @@
 
 	signer := newSigner()
 	d, s := &bufferCloser{}, &bufferCloser{}
-	if err := signingWrite(d, s, signer, [][]byte{testutil.RandomBytes(100)}, &Options{ChunkSizeBytes: 7}); err != nil {
+	if err := signingWrite(d, s, signer, [][]byte{testutil.RandomBytes(100)}, &serialization.Options{ChunkSizeBytes: 7}); err != nil {
 		t.Fatalf("signingWrite failed: %s", err)
 	}
 
@@ -144,7 +145,7 @@
 
 func TestEdgeCases(t *testing.T) {
 	var d, s io.ReadWriteCloser
-	var signer Signer
+	var signer serialization.Signer
 	var key security.PublicKey
 
 	for i := 0; i < 3; i++ {
@@ -162,10 +163,10 @@
 			key = nil
 		}
 		matchErr := "cannot be nil"
-		if _, err := NewSigningWriteCloser(d, s, signer, nil); !matchesErrorPattern(err, matchErr) {
+		if _, err := serialization.NewSigningWriteCloser(d, s, signer, nil); !matchesErrorPattern(err, matchErr) {
 			t.Errorf("NewSigningWriter(%p, %p, %p, ...) returned: %v, want to match: %v", d, s, signer, err, matchErr)
 		}
-		if _, err := NewVerifyingReader(d, s, key); !matchesErrorPattern(err, matchErr) {
+		if _, err := serialization.NewVerifyingReader(d, s, key); !matchesErrorPattern(err, matchErr) {
 			t.Errorf("NewVerifyingReader(%p, %p, %p) returned: %v, want to match: %v", d, s, key, err, matchErr)
 		}
 	}
diff --git a/services/identity/revocation/revocation_test.go b/services/identity/revocation/revocation_test.go
index c43b94f..3f6e357 100644
--- a/services/identity/revocation/revocation_test.go
+++ b/services/identity/revocation/revocation_test.go
@@ -3,6 +3,7 @@
 import (
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	services "v.io/core/veyron/services/security"
 	"v.io/core/veyron/services/security/discharger"
@@ -36,7 +37,7 @@
 }
 
 func TestDischargeRevokeDischargeRevokeDischarge(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	dcKey, dc, revoker, closeFunc := revokerSetup(t, ctx)
diff --git a/services/mgmt/application/impl/acl_test.go b/services/mgmt/application/impl/acl_test.go
index f8b9ded..c16dd3f 100644
--- a/services/mgmt/application/impl/acl_test.go
+++ b/services/mgmt/application/impl/acl_test.go
@@ -49,8 +49,9 @@
 	publishName := args[0]
 	storedir := args[1]
 
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
@@ -76,7 +77,7 @@
 }
 
 func TestApplicationUpdateACL(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -89,7 +90,7 @@
 
 	otherCtx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal())
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	idp := tsecurity.NewIDProvider("root")
@@ -211,7 +212,7 @@
 }
 
 func TestPerAppACL(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -224,7 +225,7 @@
 
 	otherCtx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal())
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	idp := tsecurity.NewIDProvider("root")
@@ -354,8 +355,9 @@
 }
 
 func TestInitialACLSet(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
diff --git a/services/mgmt/application/impl/impl_test.go b/services/mgmt/application/impl/impl_test.go
index 3b8287a..46667ad 100644
--- a/services/mgmt/application/impl/impl_test.go
+++ b/services/mgmt/application/impl/impl_test.go
@@ -6,7 +6,6 @@
 	"reflect"
 	"testing"
 
-	"v.io/core/veyron2"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/services/mgmt/application"
 	"v.io/core/veyron2/verror2"
@@ -21,7 +20,7 @@
 // TestInterface tests that the implementation correctly implements
 // the Application interface.
 func TestInterface(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	dir, prefix := "", ""
@@ -150,7 +149,7 @@
 }
 
 func TestPreserveAcrossRestarts(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	dir, prefix := "", ""
diff --git a/services/mgmt/binary/impl/acl_test.go b/services/mgmt/binary/impl/acl_test.go
index 6c16291..67e468b 100644
--- a/services/mgmt/binary/impl/acl_test.go
+++ b/services/mgmt/binary/impl/acl_test.go
@@ -47,7 +47,7 @@
 	publishName := args[0]
 	storedir := args[1]
 
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
@@ -77,7 +77,7 @@
 }
 
 func TestBinaryRootACL(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
diff --git a/services/mgmt/binary/impl/http_test.go b/services/mgmt/binary/impl/http_test.go
index 6eb0142..ec0b411 100644
--- a/services/mgmt/binary/impl/http_test.go
+++ b/services/mgmt/binary/impl/http_test.go
@@ -18,8 +18,9 @@
 
 // TestHTTP checks that HTTP download works.
 func TestHTTP(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	// TODO(caprita): This is based on TestMultiPart (impl_test.go).  Share
diff --git a/services/mgmt/binary/impl/impl_test.go b/services/mgmt/binary/impl/impl_test.go
index 3fcad12..172f653 100644
--- a/services/mgmt/binary/impl/impl_test.go
+++ b/services/mgmt/binary/impl/impl_test.go
@@ -72,8 +72,9 @@
 // all possible valid values of the depth used for the directory
 // hierarchy that stores binary objects in the local file system.
 func TestHierarchy(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	for i := 0; i < md5.Size; i++ {
@@ -125,8 +126,9 @@
 // uploads and downloads ranging the number of parts the test binary
 // consists of.
 func TestMultiPart(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	for length := 2; length < 5; length++ {
@@ -178,8 +180,9 @@
 // resumption ranging the number of parts the uploaded binary consists
 // of.
 func TestResumption(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	for length := 2; length < 5; length++ {
@@ -224,8 +227,9 @@
 
 // TestErrors checks that the binary interface correctly reports errors.
 func TestErrors(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	binary, _, _, cleanup := startServer(t, ctx, 2)
@@ -290,8 +294,9 @@
 }
 
 func TestGlob(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	_, ep, _, cleanup := startServer(t, ctx, 2)
diff --git a/services/mgmt/build/impl/impl_test.go b/services/mgmt/build/impl/impl_test.go
index dd1573e..6cdb33e 100644
--- a/services/mgmt/build/impl/impl_test.go
+++ b/services/mgmt/build/impl/impl_test.go
@@ -114,7 +114,7 @@
 // TestSuccess checks that the build server successfully builds a
 // package that depends on the standard Go library.
 func TestSuccess(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
@@ -149,7 +149,7 @@
 // TestEmpty checks that the build server successfully builds a
 // package that does not produce a binary.
 func TestEmpty(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
@@ -184,7 +184,7 @@
 // TestFailure checks that the build server fails to build a package
 // consisting of an empty file.
 func TestFailure(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
diff --git a/services/mgmt/debug/dispatcher_test.go b/services/mgmt/debug/dispatcher_test.go
index f1a7017..7feb42a 100644
--- a/services/mgmt/debug/dispatcher_test.go
+++ b/services/mgmt/debug/dispatcher_test.go
@@ -49,7 +49,7 @@
 }
 
 func TestDebugServer(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	tracedContext := func(ctx *context.T) *context.T {
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index 7ec36ed..d146f15 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -130,7 +130,7 @@
 // publish the server under as an argument.  Additional arguments can optionally
 // specify device manager config settings.
 func deviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 
 	args = args[1:]
 	if len(args) == 0 {
@@ -248,8 +248,9 @@
 }
 
 func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	args = args[1:]
@@ -307,12 +308,8 @@
 // command. Further versions are started through the soft link that the device
 // manager itself updates.
 func TestDeviceManagerUpdateAndRevert(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, veyron2.GetPrincipal(ctx))
@@ -552,12 +549,8 @@
 // TestAppLifeCycle installs an app, starts it, suspends it, resumes it, and
 // then stops it.
 func TestAppLifeCycle(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -616,7 +609,7 @@
 	instance1ID := startApp(t, ctx, appID)
 
 	instanceDebug := debug(t, ctx, appID, instance1ID)
-	if !strings.Contains(instanceDebug, "Blessing Store: Default blessings: test-principal/forapp/google naps") {
+	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp/google naps", testutil.TestBlessing)) {
 		t.Fatalf("debug response doesn't contain expected info: %v", instanceDebug)
 	}
 
@@ -795,12 +788,8 @@
 // TestDeviceManagerClaim claims a devicemanager and tests ACL permissions on
 // its methods.
 func TestDeviceManagerClaim(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -874,12 +863,8 @@
 }
 
 func TestDeviceManagerUpdateACL(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -985,12 +970,8 @@
 // This should bring up a functioning device manager.  In the end it runs
 // Uninstall and verifies that the installation is gone.
 func TestDeviceManagerInstallation(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -1047,12 +1028,8 @@
 }
 
 func TestDeviceManagerGlobAndDebug(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -1219,12 +1196,8 @@
 }
 
 func TestDeviceManagerPackages(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -1297,12 +1270,8 @@
 // TODO(rjkroege): Verify that associations persist across restarts once
 // permanent storage is added.
 func TestAccountAssociation(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
@@ -1405,12 +1374,8 @@
 }
 
 func TestAppWithSuidHelper(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
-	ctx, err := veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("test-principal"))
-	if err != nil {
-		panic(err)
-	}
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
diff --git a/services/mgmt/device/impl/proxy_invoker_test.go b/services/mgmt/device/impl/proxy_invoker_test.go
index 2668160..237770b 100644
--- a/services/mgmt/device/impl/proxy_invoker_test.go
+++ b/services/mgmt/device/impl/proxy_invoker_test.go
@@ -18,8 +18,9 @@
 // TODO(toddw): Add tests of Signature and MethodSignature.
 
 func TestProxyInvoker(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	// server1 is a normal server
diff --git a/services/mgmt/lib/binary/impl_test.go b/services/mgmt/lib/binary/impl_test.go
index 36d1070..8f51b95 100644
--- a/services/mgmt/lib/binary/impl_test.go
+++ b/services/mgmt/lib/binary/impl_test.go
@@ -81,8 +81,9 @@
 // TestBufferAPI tests the binary repository client-side library
 // interface using buffers.
 func TestBufferAPI(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	von, cleanup := setupRepository(t, ctx)
@@ -113,8 +114,9 @@
 // TestFileAPI tests the binary repository client-side library
 // interface using files.
 func TestFileAPI(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	von, cleanup := setupRepository(t, ctx)
@@ -169,8 +171,9 @@
 // TestDownloadURL tests the binary repository client-side library
 // DownloadURL method.
 func TestDownloadURL(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	veyron2.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	von, cleanup := setupRepository(t, ctx)
diff --git a/services/mgmt/logreader/impl/logfile_test.go b/services/mgmt/logreader/impl/logfile_test.go
index 62e3b78..f47f8a0 100644
--- a/services/mgmt/logreader/impl/logfile_test.go
+++ b/services/mgmt/logreader/impl/logfile_test.go
@@ -6,6 +6,7 @@
 	"path"
 	"testing"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/logreader/impl"
 
@@ -61,7 +62,7 @@
 }
 
 func TestReadLogImplNoFollow(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	workdir, err := ioutil.TempDir("", "logreadertest")
@@ -148,7 +149,7 @@
 }
 
 func TestReadLogImplWithFollow(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	workdir, err := ioutil.TempDir("", "logreadertest")
diff --git a/services/mgmt/pprof/client/proxy_test.go b/services/mgmt/pprof/client/proxy_test.go
index a5c4630..2db0631 100644
--- a/services/mgmt/pprof/client/proxy_test.go
+++ b/services/mgmt/pprof/client/proxy_test.go
@@ -9,6 +9,7 @@
 	"v.io/core/veyron2"
 	"v.io/core/veyron2/security"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/pprof/client"
 	"v.io/core/veyron/services/mgmt/pprof/impl"
@@ -23,7 +24,7 @@
 }
 
 func TestPProfProxy(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	s, err := veyron2.NewServer(ctx)
diff --git a/services/mgmt/profile/impl/impl_test.go b/services/mgmt/profile/impl/impl_test.go
index cc27ee4..8b7e735 100644
--- a/services/mgmt/profile/impl/impl_test.go
+++ b/services/mgmt/profile/impl/impl_test.go
@@ -10,6 +10,7 @@
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/services/mgmt/build"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/profile"
 	"v.io/core/veyron/services/mgmt/repository"
@@ -30,7 +31,7 @@
 // TestInterface tests that the implementation correctly implements
 // the Profile interface.
 func TestInterface(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	// Setup and start the profile repository server.
@@ -108,7 +109,7 @@
 }
 
 func TestPreserveAcrossRestarts(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	// Setup and start the profile repository server.
diff --git a/services/mgmt/profile/profiled/testdata/integration_test.go b/services/mgmt/profile/profiled/testdata/integration_test.go
index d331fd0..c20c8e3 100644
--- a/services/mgmt/profile/profiled/testdata/integration_test.go
+++ b/services/mgmt/profile/profiled/testdata/integration_test.go
@@ -1,7 +1,6 @@
 package integration_test
 
 import (
-	"io/ioutil"
 	"os"
 	"strings"
 	"syscall"
@@ -9,14 +8,12 @@
 
 	"v.io/core/veyron/lib/modules"
 	"v.io/core/veyron/lib/testutil/integration"
-	"v.io/core/veyron/lib/testutil/security"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron2/naming"
 )
 
-func profileCommandOutput(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, expectError bool, command, credentials, name, suffix string) string {
+func profileCommandOutput(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, expectError bool, command, name, suffix string) string {
 	labelArgs := []string{
-		"-veyron.credentials=" + credentials,
 		"-veyron.namespace.root=" + env.RootMT(),
 		command, naming.Join(name, suffix),
 	}
@@ -32,18 +29,16 @@
 	return strings.TrimSpace(out)
 }
 
-func putProfile(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, credentials, name, suffix string) {
+func putProfile(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, name, suffix string) {
 	putArgs := []string{
-		"-veyron.credentials=" + credentials,
 		"-veyron.namespace.root=" + env.RootMT(),
 		"put", naming.Join(name, suffix),
 	}
 	profileBin.Start(putArgs...).WaitOrDie(os.Stdout, os.Stderr)
 }
 
-func removeProfile(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, credentials, name, suffix string) {
+func removeProfile(t *testing.T, env integration.TestEnvironment, profileBin integration.TestBinary, name, suffix string) {
 	removeArgs := []string{
-		"-veyron.credentials=" + credentials,
 		"-veyron.namespace.root=" + env.RootMT(),
 		"remove", naming.Join(name, suffix),
 	}
@@ -58,23 +53,12 @@
 	env := integration.NewTestEnvironment(t)
 	defer env.Cleanup()
 
-	// Generate credentials.
-	serverCred, serverPrin := security.NewCredentials("server")
-	defer os.RemoveAll(serverCred)
-	clientCred, _ := security.ForkCredentials(serverPrin, "client")
-	defer os.RemoveAll(clientCred)
-
 	// Start the profile repository.
 	profileRepoName := "test-profile-repo"
-	profileRepoStore, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("TempDir() failed: %v", err)
-	}
-	defer os.RemoveAll(profileRepoStore)
+	profileRepoStore := env.TempDir()
 	args := []string{
 		"-name=" + profileRepoName, "-store=" + profileRepoStore,
 		"-veyron.tcp.address=127.0.0.1:0",
-		"-veyron.credentials=" + serverCred,
 		"-veyron.namespace.root=" + env.RootMT(),
 	}
 	serverBin := env.BuildGoPkg("v.io/core/veyron/services/mgmt/profile/profiled")
@@ -85,34 +69,34 @@
 
 	// Create a profile.
 	const profile = "test-profile"
-	putProfile(t, env, clientBin, clientCred, profileRepoName, profile)
+	putProfile(t, env, clientBin, profileRepoName, profile)
 
 	// Retrieve the profile label and check it matches the
 	// expected label.
-	profileLabel := profileCommandOutput(t, env, clientBin, false, "label", clientCred, profileRepoName, profile)
+	profileLabel := profileCommandOutput(t, env, clientBin, false, "label", profileRepoName, profile)
 	if got, want := profileLabel, "example"; got != want {
 		t.Fatalf("unexpected output: got %v, want %v", got, want)
 	}
 
 	// Retrieve the profile description and check it matches the
 	// expected description.
-	profileDesc := profileCommandOutput(t, env, clientBin, false, "description", clientCred, profileRepoName, profile)
+	profileDesc := profileCommandOutput(t, env, clientBin, false, "description", profileRepoName, profile)
 	if got, want := profileDesc, "Example profile to test the profile manager implementation."; got != want {
 		t.Fatalf("unexpected output: got %v, want %v", got, want)
 	}
 
 	// Retrieve the profile specification and check it matches the
 	// expected specification.
-	profileSpec := profileCommandOutput(t, env, clientBin, false, "specification", clientCred, profileRepoName, profile)
+	profileSpec := profileCommandOutput(t, env, clientBin, false, "specification", profileRepoName, profile)
 	if got, want := profileSpec, `profile.Specification{Label:"example", Description:"Example profile to test the profile manager implementation.", Arch:"amd64", OS:"linux", Format:"ELF", Libraries:map[profile.Library]struct {}{profile.Library{Name:"foo", MajorVersion:"1", MinorVersion:"0"}:struct {}{}}}`; got != want {
 		t.Fatalf("unexpected output: got %v, want %v", got, want)
 	}
 
 	// Remove the profile.
-	removeProfile(t, env, clientBin, clientCred, profileRepoName, profile)
+	removeProfile(t, env, clientBin, profileRepoName, profile)
 
 	// Check that the profile no longer exists.
-	profileCommandOutput(t, env, clientBin, true, "label", clientCred, profileRepoName, profile)
-	profileCommandOutput(t, env, clientBin, true, "description", clientCred, profileRepoName, profile)
-	profileCommandOutput(t, env, clientBin, true, "specification", clientCred, profileRepoName, profile)
+	profileCommandOutput(t, env, clientBin, true, "label", profileRepoName, profile)
+	profileCommandOutput(t, env, clientBin, true, "description", profileRepoName, profile)
+	profileCommandOutput(t, env, clientBin, true, "specification", profileRepoName, profile)
 }
diff --git a/services/mgmt/stats/impl/stats_test.go b/services/mgmt/stats/impl/stats_test.go
index 493f454..1535ee1 100644
--- a/services/mgmt/stats/impl/stats_test.go
+++ b/services/mgmt/stats/impl/stats_test.go
@@ -48,7 +48,7 @@
 }
 
 func TestStatsImpl(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	endpoint, stop := startServer(t, ctx)
diff --git a/services/mgmt/vtrace/impl/vtrace_test.go b/services/mgmt/vtrace/impl/vtrace_test.go
index 7a4d5f8..f8fbb9f 100644
--- a/services/mgmt/vtrace/impl/vtrace_test.go
+++ b/services/mgmt/vtrace/impl/vtrace_test.go
@@ -8,12 +8,13 @@
 	service "v.io/core/veyron2/services/mgmt/vtrace"
 	"v.io/core/veyron2/vtrace"
 
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/vtrace/impl"
 )
 
 func TestVtraceServer(t *testing.T) {
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	server, err := veyron2.NewServer(ctx)
diff --git a/services/mounttable/lib/mounttable_test.go b/services/mounttable/lib/mounttable_test.go
index a82aa46..a1404d9 100644
--- a/services/mounttable/lib/mounttable_test.go
+++ b/services/mounttable/lib/mounttable_test.go
@@ -448,7 +448,7 @@
 }
 
 func TestGlob(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -547,7 +547,7 @@
 }
 
 func TestCleanup(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -601,7 +601,7 @@
 }
 
 func TestServerFormat(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -616,7 +616,7 @@
 }
 
 func TestExpiry(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -658,7 +658,7 @@
 
 func initTest() (rootCtx *context.T, aliceCtx *context.T, bobCtx *context.T, shutdown veyron2.Shutdown) {
 	testutil.Init()
-	ctx, shutdown := veyron2.Init()
+	ctx, shutdown := testutil.InitForTest()
 
 	var err error
 	if rootCtx, err = veyron2.SetPrincipal(ctx, tsecurity.NewPrincipal("root")); err != nil {
diff --git a/services/mounttable/lib/neighborhood_test.go b/services/mounttable/lib/neighborhood_test.go
index 9290c77..9d673a9 100644
--- a/services/mounttable/lib/neighborhood_test.go
+++ b/services/mounttable/lib/neighborhood_test.go
@@ -27,8 +27,9 @@
 }
 
 func TestNeighborhood(t *testing.T) {
-	rootCtx, shutdown := veyron2.Init()
+	rootCtx, shutdown := testutil.InitForTest()
 	defer shutdown()
+
 	vlog.Infof("TestNeighborhood")
 	server, err := veyron2.NewServer(rootCtx)
 	if err != nil {
diff --git a/tools/application/impl_test.go b/tools/application/impl_test.go
index de607ae..7b20e9f 100644
--- a/tools/application/impl_test.go
+++ b/tools/application/impl_test.go
@@ -16,7 +16,7 @@
 	"v.io/core/veyron2/services/security/access"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/repository"
 )
@@ -117,12 +117,8 @@
 
 func TestApplicationClient(t *testing.T) {
 	var shutdown veyron2.Shutdown
-	gctx, shutdown = veyron2.Init()
+	gctx, shutdown = testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
 
 	server, endpoint, err := startServer(t, gctx)
 	if err != nil {
diff --git a/tools/binary/impl_test.go b/tools/binary/impl_test.go
index 0015ddf..0bfe953 100644
--- a/tools/binary/impl_test.go
+++ b/tools/binary/impl_test.go
@@ -21,7 +21,7 @@
 	"v.io/core/veyron2/services/security/access"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -121,12 +121,8 @@
 
 func TestBinaryClient(t *testing.T) {
 	var shutdown veyron2.Shutdown
-	gctx, shutdown = veyron2.Init()
+	gctx, shutdown = testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
 
 	server, endpoint, err := startServer(t, gctx)
 	if err != nil {
diff --git a/tools/build/impl_test.go b/tools/build/impl_test.go
index d2550e6..436b8b9 100644
--- a/tools/build/impl_test.go
+++ b/tools/build/impl_test.go
@@ -14,7 +14,7 @@
 	verror "v.io/core/veyron2/verror2"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -64,12 +64,8 @@
 
 func TestBuildClient(t *testing.T) {
 	var shutdown veyron2.Shutdown
-	gctx, shutdown = veyron2.Init()
+	gctx, shutdown = testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
 
 	server, endpoint := startServer(gctx, t)
 	defer stopServer(t, server)
diff --git a/tools/debug/testdata/integration_test.go b/tools/debug/testdata/integration_test.go
index 8216925..ed17bcc 100644
--- a/tools/debug/testdata/integration_test.go
+++ b/tools/debug/testdata/integration_test.go
@@ -185,9 +185,9 @@
 	}
 	traceId := fields[2]
 
-	// Do a sanity check on the trace ID: it should be a 32-character hex ID.
-	if match, _ := regexp.MatchString("[0-9a-f]{32}", traceId); !match {
-		t.Fatalf("wanted a 32-character hex ID, got %s", traceId)
+	// Do a sanity check on the trace ID: it should be a 32-character hex ID prefixed with 0x
+	if match, _ := regexp.MatchString("0x[0-9a-f]{32}", traceId); !match {
+		t.Fatalf("wanted a 32-character hex ID prefixed with 0x, got %s", traceId)
 	}
 
 	// Do another traced read, this will generate a new trace entry.
diff --git a/tools/mgmt/device/impl/util_test.go b/tools/mgmt/device/impl/util_test.go
index e108e49..a369b94 100644
--- a/tools/mgmt/device/impl/util_test.go
+++ b/tools/mgmt/device/impl/util_test.go
@@ -4,7 +4,7 @@
 	"v.io/core/veyron2"
 	"v.io/core/veyron2/context"
 
-	"v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/tools/mgmt/device/impl"
 )
@@ -12,12 +12,8 @@
 var gctx *context.T
 
 func initTest() veyron2.Shutdown {
-	ctx, shutdown := veyron2.Init()
-	var err error
-	if ctx, err = veyron2.SetPrincipal(ctx, security.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
-	gctx = ctx
+	var shutdown veyron2.Shutdown
+	gctx, shutdown = testutil.InitForTest()
 	impl.SetGlobalContext(gctx)
 	return func() {
 		shutdown()
diff --git a/tools/mgmt/test.sh b/tools/mgmt/test.sh
index 9aa9e2b..7a28463 100755
--- a/tools/mgmt/test.sh
+++ b/tools/mgmt/test.sh
@@ -160,8 +160,8 @@
   fi
 
   # Verify the device's default blessing is as expected.
-  shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${DM_NAME}/__debug/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \
-    "alice/myworkstation" "${LINENO}"
+  shell_test::assert_contains "$("${DEBUG_BIN}" stats read "${DM_NAME}/__debug/stats/security/principal/*/blessingstore" | head -1)" \
+    "Default blessings: alice/myworkstation" "${LINENO}"
 
   # Get the device's profile.
   local -r DEVICE_PROFILE=$("${DEVICE_BIN}" describe "${DM_NAME}/device" | sed -e 's/{Profiles:map\[\(.*\):{}]}/\1/')
@@ -219,8 +219,8 @@
   # TODO(rjkroege): Verify that the app is actually running as ${SUID_USER}
 
   # Verify the app's default blessing.
-  shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${INSTANCE_NAME}/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \
-    "alice/myapp/BINARYD" "${LINENO}"
+  shell_test::assert_contains "$("${DEBUG_BIN}" stats read "${INSTANCE_NAME}/stats/security/principal/*/blessingstore" | head -1)" \
+    "Default blessings: alice/myapp/BINARYD" "${LINENO}"
 
   # Stop the instance.
   echo ">> Stopping ${INSTANCE_NAME}"
diff --git a/tools/mounttable/impl_test.go b/tools/mounttable/impl_test.go
index d1aefc9..43c650e 100644
--- a/tools/mounttable/impl_test.go
+++ b/tools/mounttable/impl_test.go
@@ -14,7 +14,7 @@
 	"v.io/core/veyron2/services/security/access"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 )
 
@@ -103,12 +103,8 @@
 
 func TestMountTableClient(t *testing.T) {
 	var shutdown veyron2.Shutdown
-	gctx, shutdown = veyron2.Init()
+	gctx, shutdown = testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
 
 	server, endpoint, err := startServer(t, gctx)
 	if err != nil {
diff --git a/tools/profile/impl_test.go b/tools/profile/impl_test.go
index 25de771..f334e31 100644
--- a/tools/profile/impl_test.go
+++ b/tools/profile/impl_test.go
@@ -14,7 +14,7 @@
 	"v.io/core/veyron2/services/mgmt/build"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/services/mgmt/profile"
 	"v.io/core/veyron/services/mgmt/repository"
@@ -110,12 +110,8 @@
 
 func TestProfileClient(t *testing.T) {
 	var shutdown veyron2.Shutdown
-	gctx, shutdown = veyron2.Init()
+	gctx, shutdown = testutil.InitForTest()
 	defer shutdown()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
 
 	server, endpoint, err := startServer(t, gctx)
 	if err != nil {
diff --git a/tools/uniqueid/doc.go b/tools/uniqueid/doc.go
new file mode 100644
index 0000000..5fdbcab
--- /dev/null
+++ b/tools/uniqueid/doc.go
@@ -0,0 +1,57 @@
+// This file was auto-generated via go generate.
+// DO NOT UPDATE MANUALLY
+
+/*
+The uniqueid tool generates unique ids. It also has an option of automatically
+substituting unique ids with placeholders in files.
+
+Usage:
+   uniqueid <command>
+
+The uniqueid commands are:
+   generate    Generates UniqueIds
+   inject      Injects UniqueIds into existing files
+   help        Display help for commands or topics
+Run "uniqueid help [command]" for command usage.
+
+Uniqueid Generate
+
+Generates unique ids and outputs them to standard out.
+
+Usage:
+   uniqueid generate
+
+Uniqueid Inject
+
+Injects UniqueIds into existing files. Strings of the form "$UNIQUEID$" will be
+replaced with generated ids.
+
+Usage:
+   uniqueid inject <filenames>
+
+<filenames> List of files to inject unique ids into
+
+Uniqueid Help
+
+Help with no args displays the usage of the parent command.
+
+Help with args displays the usage of the specified sub-command or help topic.
+
+"help ..." recursively displays help for all commands and topics.
+
+The output is formatted to a target width in runes.  The target width is
+determined by checking the environment variable CMDLINE_WIDTH, falling back on
+the terminal width from the OS, falling back on 80 chars.  By setting
+CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
+if x == 0 or is unset one of the fallbacks is used.
+
+Usage:
+   uniqueid help [flags] [command/topic ...]
+
+[command/topic ...] optionally identifies a specific sub-command or help topic.
+
+The uniqueid help flags are:
+ -style=text
+   The formatting style for help output, either "text" or "godoc".
+*/
+package main
diff --git a/tools/uniqueid/main.go b/tools/uniqueid/main.go
new file mode 100644
index 0000000..ce003d0
--- /dev/null
+++ b/tools/uniqueid/main.go
@@ -0,0 +1,110 @@
+// The following enables go generate to generate the doc.go file.
+//go:generate go run $VANADIUM_ROOT/release/go/src/v.io/lib/cmdline/testdata/gendoc.go .
+
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"regexp"
+
+	"v.io/core/veyron2/uniqueid"
+	"v.io/lib/cmdline"
+)
+
+func main() {
+	os.Exit(cmdUniqueId.Main())
+}
+
+var cmdUniqueId = &cmdline.Command{
+	Name:  "uniqueid",
+	Short: "Generates UniqueIds.",
+	Long: `
+The uniqueid tool generates unique ids.
+It also has an option of automatically substituting unique ids with placeholders in files.
+`,
+	Children: []*cmdline.Command{cmdGenerate, cmdInject},
+	Topics:   []cmdline.Topic{},
+}
+
+var cmdGenerate = &cmdline.Command{
+	Run:   runGenerate,
+	Name:  "generate",
+	Short: "Generates UniqueIds",
+	Long: `
+Generates unique ids and outputs them to standard out.
+`,
+	ArgsName: "",
+	ArgsLong: "",
+}
+
+var cmdInject = &cmdline.Command{
+	Run:   runInject,
+	Name:  "inject",
+	Short: "Injects UniqueIds into existing files",
+	Long: `
+Injects UniqueIds into existing files.
+Strings of the form "$UNIQUEID$" will be replaced with generated ids.
+`,
+	ArgsName: "<filenames>",
+	ArgsLong: "<filenames> List of files to inject unique ids into",
+}
+
+// runGenerate implements the generate command which outputs generated ids to stdout.
+func runGenerate(command *cmdline.Command, args []string) error {
+	if len(args) > 0 {
+		return command.UsageErrorf("expected 0 args, got %d", len(args))
+	}
+	id, err := uniqueid.Random()
+	if err != nil {
+		return err
+	}
+	fmt.Printf("%#v", id)
+	return nil
+}
+
+// runInject implements the inject command which replaces $UNIQUEID$ strings with generated ids.
+func runInject(command *cmdline.Command, args []string) error {
+	if len(args) == 0 {
+		return command.UsageErrorf("expected at least one file arg, got 0")
+	}
+	for _, arg := range args {
+		if err := injectIntoFile(arg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// injectIntoFile replaces $UNIQUEID$ strings when they exist in the specified file.
+func injectIntoFile(filename string) error {
+	inbytes, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+
+	// Replace $UNIQUEID$ with generated ids.
+	re, err := regexp.Compile("[$]UNIQUEID")
+	if err != nil {
+		return err
+	}
+	replaced := re.ReplaceAllFunc(inbytes, func(match []byte) []byte {
+		id, randErr := uniqueid.Random()
+		if randErr != nil {
+			err = randErr
+		}
+		return []byte(fmt.Sprintf("%#v", id))
+	})
+	if err != nil {
+		return err
+	}
+
+	// If the file with injections is different, write it to disk.
+	if !bytes.Equal(inbytes, replaced) {
+		fmt.Printf("Updated: %s\n", filename)
+		return ioutil.WriteFile(filename, replaced, 0)
+	}
+	return nil
+}
diff --git a/tools/vrpc/vrpc_test.go b/tools/vrpc/vrpc_test.go
index e039db9..429552f 100644
--- a/tools/vrpc/vrpc_test.go
+++ b/tools/vrpc/vrpc_test.go
@@ -9,7 +9,7 @@
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/vlog"
 
-	tsecurity "v.io/core/veyron/lib/testutil/security"
+	"v.io/core/veyron/lib/testutil"
 	_ "v.io/core/veyron/profiles"
 	"v.io/core/veyron/tools/vrpc/test_base"
 )
@@ -109,11 +109,7 @@
 
 func initTest(t *testing.T) (name string, shutdown veyron2.Shutdown) {
 	// The gctx initialized here is the global context defined in vrpc.go.
-	gctx, shutdown = veyron2.Init()
-	var err error
-	if gctx, err = veyron2.SetPrincipal(gctx, tsecurity.NewPrincipal("test-blessing")); err != nil {
-		panic(err)
-	}
+	gctx, shutdown = testutil.InitForTest()
 
 	ipcServer, err := veyron2.NewServer(gctx)
 	if err != nil {