Force unsecure

no-compat JSON.decode is now `secure` by default. Forcing `secure =
false` will keep this code & specs running "as usual".
Merge pull request #1238 from SergioCrisostomo/form-json

Force unsecure