explain why /secure is protected