use a default value of allowAll for the two securitySettings