Name only strikes me as a fairer compromise between security and usability.
I thought name-only was the default.
I thought name-only was the default.