Disable login/user creation

[dgoerger]

Currently, if you can authenticate through CAS, you can go to the Reservations URL and create your own account on that server.

We should have an admin setting to disable this behavior, if admins want to limit users to a specific subset. This subset would either have to be created one-by-one manually, or imported via the CSV import function.

[orenyk]

This seems pretty important, I'd like to add this to v4.0 as part of our initial v4.x release for testing.

[orenyk]

Bumping to v4.1 so we can close out v4.0 with existing issues