Made authentication policy configurable

and set up some reasonable defaults in production and development
configuration files