Did you try not setting the value at all, or removing the value from the $SPLUNK_HOME/etc/system/default/authorize.conf file?
Capabilities are disabled by default, so if you list it in authorize.conf, it expects for you to use enabled as the value. I think the disconnect is that you believe that you have to list the setting even if you want to disable it, that's not the case (since capabilities are disabled by default.)
Give it a try. I'll reply to your feedback email and we can continue the discussion there, or we can also do it here.