title: How to disable/enable authentication in ASP.NET Core 2.0 based on settings?
body: <p>We've got an API in ASP.NET Core 2.0, secured with 2 different type JwtTokens. Our controllers have the <code>[Authorize]</code> attribute, and specifying the <code>AuthorizationSchemes</code></p>
  
  <p>That's all working fine, except that I want to disable this based on appsettings.</p>
  
  <p>I have spent hours, but no solution yet. I've had a look at policies, requirements, etc. but all of them expect a token; thus the policy / requirement won't be evaluated if the token is not present.</p>
  
  <p>I've also looked at a custom <code>Authorize</code> attribute, but that's advised against.</p>