Explicitly state that CAS should be used as an authentication backend.

Otherwise it's a bit of an oversight.