[matthewmacleod]

I don't necessarily disagree with you, but it's still an astonishingly bad practice as a default.

If there's one thing we should have learned from Rails' various security failures, it's that things must be secure by default.