I think there should probably be a bit of documentation in `dev.py` where the AUTH dict would be set.  Most of it should point to `common/djangoapps/auth/settings.py`, as you say, but I'm fine holding off until it's finalized and near merge.