secure param was set after the action. So there was no changing the param. Furthermore the default should be null ( keeping the same scheme )