Force unsecure

Found broken specs in _no-compat_ version. 
This is because 1.5 has changes in `JSON.decode` that break BC.

JSON.decode is now `secure` by default. 
Forcing `secure = false` will keep this code & specs running "as usual"