public function secure(array $fields = [], array $secureAttributes = [])
    {
        if (!$this->_View->getRequest()->getParam('_Token')) {
            return '';
        }
        $debugSecurity = Configure::read('debug');
        if (isset($secureAttributes['debugSecurity'])) {
            $debugSecurity = $debugSecurity && $secureAttributes['debugSecurity'];
            unset($secureAttributes['debugSecurity']);
        }
        $secureAttributes['secure'] = static::SECURE_SKIP;
        $secureAttributes['autocomplete'] = 'off';

        $tokenData = $this->_buildFieldToken(
            $this->_lastAction,
            $fields,
            $this->_unlockedFields
        );
        $tokenFields = array_merge($secureAttributes, [
            'value' => $tokenData['fields'],
        ]);
        $out = $this->hidden('_Token.fields', $tokenFields);
        $tokenUnlocked = array_merge($secureAttributes, [
            'value' => $tokenData['unlocked'],
        ]);
        $out .= $this->hidden('_Token.unlocked', $tokenUnlocked);
        if ($debugSecurity) {
            $tokenDebug = array_merge($secureAttributes, [
                'value' => urlencode(json_encode([
                    $this->_lastAction,
                    $fields,
                    $this->_unlockedFields
                ])),
            ]);
            $out .= $this->hidden('_Token.debug', $tokenDebug);
        }

        return $this->formatTemplate('hiddenBlock', ['content' => $out]);
    }