here you have examples how to set Security in Java Control Panel for Web Start Launcher
right click - open in new tab to enlarge
These are in german but the same appears in all languages
if you're starting the default client with settings made above this shows up - green arrow shows where to check
Just close the JCP console showing those attributes in manifest messages...
I recommend to have all plugins disabled in Browser and only activate when needed and with trusted sites (Youtube -> Flash) - for playing HnH it doesn't to be activated here