[api][webui] support local webui's speaking to a remote api anonymously using /public/configuration route.
make it possible to exclude specific sandboxes and hostlabels in constraints