API Allow CMS re-authentication to be completely disabled if necessary

@simonwelsh would you please review this and let me know if this works for you?