Move this up with the other auth settings.
Also please explicitly disable by default in common.py.