Fix misplaced setting in security docs. Fix #393