diff --git a/core/core/src/sf_core/map_std_impl/mod.rs b/core/core/src/sf_core/map_std_impl/mod.rs
index 2995a80..466de47 100644
--- a/core/core/src/sf_core/map_std_impl/mod.rs
+++ b/core/core/src/sf_core/map_std_impl/mod.rs
@@ -90,9 +90,11 @@ impl MapStdUnstable for MapStdImpl {
         }
     }
 
-    fn http_call(&mut self, mut params: MapHttpRequest, security: MapHttpRequestSecurity) -> Result<Handle, MapHttpCallError> {
+    fn http_call(&mut self, mut params: MapHttpRequest, security: Option<MapHttpRequestSecurity>) -> Result<Handle, MapHttpCallError> {
         let security_map = self.security.as_ref().unwrap();
-        resolve_security(security_map, &mut params, &security)?;
+        if let Some(ref security) = security {
+            resolve_security(security_map, &mut params, security)?;
+        }
 
         // IDEA: add profile, provider info as well?
         params
diff --git a/core/core_to_map_std/src/unstable/mod.rs b/core/core_to_map_std/src/unstable/mod.rs
index ee52d58..9bddcf4 100644
--- a/core/core_to_map_std/src/unstable/mod.rs
+++ b/core/core_to_map_std/src/unstable/mod.rs
@@ -182,6 +182,9 @@ macro_rules! map_value {
     };
 }
 
+#[derive(Deserialize)]
+#[serde(tag = "kind", content = "ids")]
+#[serde(rename_all = "kebab-case")]
 pub enum HttpRequestSecurity {
     FirstValid(Vec<String>),
     All(Vec<String>),
@@ -305,7 +308,7 @@ pub trait MapStdUnstable {
     fn stream_close(&mut self, handle: Handle) -> std::io::Result<()>;
 
     // http
-    fn http_call(&mut self, params: HttpRequest, security: HttpRequestSecurity) -> Result<Handle, HttpCallError>;
+    fn http_call(&mut self, params: HttpRequest, security: Option<HttpRequestSecurity>) -> Result<Handle, HttpCallError>;
     fn http_call_head(&mut self, handle: Handle) -> Result<HttpResponse, HttpCallHeadError>;
 
     // input and output
@@ -318,16 +321,6 @@ pub trait MapStdUnstable {
 // MESSAGES //
 //////////////
 
-#[derive(Deserialize)]
-#[serde(tag = "kind", content = "ids")]
-#[serde(rename_all = "kebab-case")]
-enum HttpRequestSecuritySettingMessage {
-    FirstValid(Vec<String>),
-    All(Vec<String>),
-    #[serde(untagged)]
-    Legacy(Option<String>)
-}
-
 define_exchange_map_to_core! {
     let state: MapStdUnstable;
     enum RequestUnstable {
@@ -337,7 +330,7 @@ define_exchange_map_to_core! {
             url: String,
             headers: HeadersMultiMap,
             query: MultiMap,
-            security: HttpRequestSecuritySettingMessage,
+            security: Option<HttpRequestSecurity>,
             body: Option<Vec<u8>>,
         } -> enum Response {
             Ok {
@@ -355,12 +348,7 @@ define_exchange_map_to_core! {
                 headers,
                 query,
                 body,
-            }, match security {
-                HttpRequestSecuritySettingMessage::FirstValid(v) => HttpRequestSecurity::FirstValid(v),
-                HttpRequestSecuritySettingMessage::All(v) => HttpRequestSecurity::All(v),
-                // Turns Option<String> into Vec<String>, the vec being empty on None
-                HttpRequestSecuritySettingMessage::Legacy(maybe_v) => HttpRequestSecurity::FirstValid(maybe_v.into_iter().collect()),
-            });
+            }, security);
 
             match handle {
                 Ok(handle) => Response::Ok {
diff --git a/core_js/map-std/src/unstable.ts b/core_js/map-std/src/unstable.ts
index 6970c0c..4e63265 100644
--- a/core_js/map-std/src/unstable.ts
+++ b/core_js/map-std/src/unstable.ts
@@ -203,6 +203,11 @@ export function fetch(url: string, options: FetchOptions): HttpRequest {
     finalBody = Array.from(bodyBuffer.inner.data);
   }
 
+  let security = options.security
+  if (typeof security === "string") {
+    security = { kind: "first-valid", ids: [security] }
+  }
+
   const response = messageExchange({
     kind: 'http-call',
     method: options.method ?? 'GET',
@@ -210,7 +215,7 @@ export function fetch(url: string, options: FetchOptions): HttpRequest {
     headers,
     query: ensureMultimap(options.query ?? {}),
     body: finalBody,
-    security: options.security,
+    security,
   });
 
   if (response.kind === 'ok') {