If the first part was SHOW and second part SELECT, it would have
thought that the command was SELECT, although the first part of
it was SHOW. It would then fail later.

Thus we need to set thd->lex to old_lex (first part) here before going
in to prepare_security().