Either way, your response prompted me to double check! Thanks!
Wups! I had turned it off in authen_LTI, but somehow there was a copy in the localOverrides as well? I don't remember if I uncommented it, or if I copied it there, or if that was a default already ...