Force specific straight.plugin version

straight.plugin 1.4.0 has a critical bug and the bugfix release was made with a
very strange version number which pip doesn't recognise as newer than 1.4.0.
Some initial permissions for the auth system