add :authn_context_decl_ref settings option