it should be but auth0 was not forcing it to be off, just highly suggesting to turn off that 'feature' unsure now.