support channel passwords and plugin whitelist

This changes the channel login with the ability to specify a password and log in with that password if it exists.

It also changes the EXTENSIONS settings to list only the name of the extensions you want loaded.

By default, users might not want to load `fredoisms` for example, because that can, err, cause HR issues with anyone that is named Alfredo.

RIGHT? RIGHT?