disable security by default