The --cdm-only flag was only preventing vault queries during DRM operations but vaults were still being loaded