secure config automatically relaxed on localdomain servers, but with override