Multi-incident orgs: check legacy incident field at auth