By default I guess we should reject.. ie enforce security