another attempt to work around FLAG_SECURE bugs