Opt-in security features aren't very useful.

> class based controllers are optional yet,because of them you introduce a feature that affect function based controllers ?

That's how competing constraints work out sometimes.

We're always looking to improve though. The code is open source, so feel free to submit a PR or fork it if you disagree. :)