@lupine There's no trick, really, you just... don't.

The trick is, users will not do any extra work once they have a thing working. So you make it so they have no recourse to get it working insecurely.