change default server-side security; closes #20