load app.settings from config file; optionally disable local authentication