Irules and persistence

It suggests that I need to manage the persistence in the Irule so that a client on https://www.myurl.com/security always gets the same /security server for the life of there session.

I certainly think it'd be preferred, but I don't think it's expressly required. Are you matching across virtuals because the client is actually touching multiple virtual servers? Your description doesn't really allude to that, and if it's simply URI-based load balancing to different pools, the built-in cookie persistence profile should be able to handle that for a single VIP.