Nit picky, but will we need all three of U, P and C?  We might want to make sure they are ALL supplied, not just one, before setting `is_secure`