settings.yml has it set to false.  i will have development and  production set to false when I update this pr.  Then, this will be correct, won't it?  check_reauthentication will return unless 
Settings.features.reauthorization has been set to true.  Isn't that what we want?