I like the idea to have a documented global JSON.secure, didn't think of that option actually.

We could just keep the code as current PR and document the possibility to use a global `JSON.secure`. 
Your last suggestion would make `JSON.secure` be ignored if secure is `false`, because `if (secure == null)` will turn false and we have a new L78 just looking for secure.

As it is it defaults to secure. If we add extra `JSON.secure = true;` as global, then the old code that followed the docs using `secure = false` will be forced to secure.

If we keep this PR, there is no break of BC in the code that active defined `secure` or `JSON.secure`.