Range-diff !267

back to !267 Pin the login disabled guard and the checkOrigin invariant