test in non-secure for now