changed validate_form_security_flag default to true