`requireCredentialSecureMode` is a replacement for `requireCredential` as
a three-valued enum. Keeping `requireCredential` as a boolean makes future
merges easier, and whether the endpoint should be allowed in secure mode
is determined by `requireCredentialSecureMode`. This implies that
`requireCredential: true, requireCredentialSecureMode: false` is an invalid
value.