isSecure defaults to false