perhaps add a comment about using secure_dir to if you want to override?