It's very hard to disable authentication protection

There is nothing really obvious to completely disable protection in the admin. Also unselecting all strategies does not seems to have any effect (at least visually), looks like CAPTCHA is the default when nothing is selected.