After bootstrapping Cassandra, we're creating a new superuser, and setting RF of system_auth keyspace to 2, NetworkTopologyStrategy. Then a nodetool repair on the system_auth KS.
The system_auth keyspace uses a QUORUM consistency level when checking authentication for the default cassandra user. For all other users created, superuser or otherwise, a LOCAL_ONE consistency level is used for authenticating.
But for my new superuser, new node members are rejected because QUORUM CL can't be achieved: