fix: secure option should explictly set to false