only enforce security when in non-live mode