finish HEFT without security checking