- allows limiting the usage of builtin auth to HTTP only (so force usage of tokens) - allows migration to something like saml keeping only super-admin for login.