More dev flags

Had to remove a few more dev flags and correct the param order in `authorize.py` and `auth.py`
This should be set to `True`.  With tornado's underlying certs we should be able to rely on the certs and setting this to `False` in any generic case is a big security risk.