Currently "Save Password & Auto Login" option only controls appearance of these checkboxes on the login screen (as description describes). But a user can still enable these settings in Spark Preferences > Login. Which is a workaround.
These two settings should also be hidden.
Related ticket for Client Control plugin https://github.com/igniterealtime/openfire-clientControl-plugin/issues/6
It looks like it was already being done for default.properties approach, but it hasn't been updated for Client Control usage. Updated the if statement to include both checks.