instead, overriding default auth config value in user_management recipe and removing it elsewhere. basically what was intended from the start