"secure *requests* work", and also "don't *want* anyone to see"