But then "meant to" is doing the heavy lifting here. You could (and should) say that a JWT library is meant to default to secure.