In advance of MBS-9207, we should disable Digest authentication for new accounts by default; they can opt-in to generating a separate Digest authentication token (MBS-14360) to be used in place of their account password for applications that require it.