overhauled safe mode logic. global setting can be overridden at call time.