You need to set the php settings in that location. Once that location is matched, the other location that handles PHP requests is no longer matched thus any PHP file in /secure will be treated like a plain txt file, exposing the php source rather the generated output.
You could enable Proxy Mode...