Added APP_AUTH_BACKEND_ALLOW_FALLBACK constant to control if auth backends should fallback