passing true should be considered too; added a test for configurating authorization disabling