spec: "disablewebsecurity" attribute