If you initially enable OLAC with authentication profile parameters using a query string and then disable OLAC, the authentication profile parameters are still passed in the query string for existing users who are logged in.