Turn off SIGN UP before going public

[thomassth]

• disallow sign up API calls without proper auth
• option to hide SIGN UP button

[vbhavh]

.take

[MaanasArora]

@vbhavh We don't assign issues. You're welcome to open a PR if you like!

[MaanasArora]

Resolved in #70.

[thomassth]

#70 only targets the client side.

It is still possible for bad actors to send server requests for sign ups with no auth.

[MaanasArora]

Oops that's right, sorry and thanks for reopening!

[MaanasArora]

@thomassth to confirm, if we don't have sign-up as public, I assume we would need a seeder to populate sign-ups? I'm adding an environment variable to configure whether sign-ups are allowed right now. (Closed and reopened as accident)