Disabling the auth was resulting in some unrealistic tests setup and expectations. It also makes it difficult to refactor any behavior in the authn/authz flow since this option can bypass most of it.