Just to back up what timlwhite was saying... nosamplecontent in AEM 6.1 was SUPPOSED to enforce all the suggested security, including the disabling of webDav, thus disabling crx/de, but it didn't do that. Yes, it did enforce most of the recommended security features, but not the dav security featu...