moved authentication_disabled to config_spec