Looks like fossil ignores localauth settings. It behaves as if it was always set to ON.