You may have
auth: true commented out, but did you start with
--keyFile or specify
keyFile in the config file? Setting the
keyFile enables authentication implicitly, so that could be your issue here.
If you want to be completely sure, temporarily shut down the
mongod instance and start it manually, specifying only the basics (port, replica set name etc.) explicitly. At least then you can be sure of what is and is not enabled.
For a running instance you can get the current options parsed from the top of the log file for the instance - they are printed out as part of the startup messaging. You can also get them by running:
getCmdLineOpts (note though that this requires admin rights, so you may see issues if you are running with auth on and don't have an admin user defined).