DNS rebinding protection defaults off when `security_settings` is omitted (non-loopback binds stay unprotected) | #8259