LOGIN_DISABLED should strictly default to False.

We should not be globally disabling authentication during testing.  The docs say "it can be convenient to globally disable authentication for unittests", which may be true but it seems illogical to disable auth during testing by default. I think the majority of people are writing unit tests against the authentication. I spent half an hour to figure out why so many of my tests where breaking in weird ways after an upgrade of a few things via pip.