allow for settings.authn_context and settings.authn_context_decl_ref