We have a similar option with SSO, but I am not 100% sure this belongs in core, maybe as a site setting default off.