[yapcguy]

This was done after the security hole was revealed.

IMHO, it should not even be an option, it should be default, always.