auth.disable now fetches from assertion (if present)

DO NOT DO THIS IN PRODUCTION (obviously)