Ok to use a configuration parameter here, but I would prefer the default to give feedback to the user as it is a standard in the web (even if I agree with you it is a security flaw) and I would prefer to keep with standard user experience.