default to disable secure