secure param was set after action. 

secure param was set after the action. So there was no changing the param. Furthermore the default should be null ( keeping the same schem
e )