resolves #497 added feature to disable auth with a default user