docs: "disablewebsecurity" attribute