CAS-1355: Set allowedToProxy to false by default (SEC_3)

https://wiki.jasig.org/display/CAS/Proposals+to+mitigate+security+risks

Originally targeted for 4.0, it could make sense to have it already for 3.5.3...