I see a **TODO** above for `:unless => :external_authentication_enabled`

Still looks like **TODO**