Why did this line change? Shouldn't it be secure by default?