Disable registration when authorization.strategy is password

Hey there,

when running squash web I'd like to disable registration since everybody who registers can join an existing project.

This functionality could be integrated fairly easy by adding a new setting to the authorization.yml and some changes to the routes and the sessions/new view, but I wanted to ask first if this feature whould be acccepted upstream.

I'd like to know if you would consider the authorization.yml the correct place to add such a feature. I'd argue that introducing a second authorization level (eg admin, user) and adding a settings page for admins where such things can be changed without having to restart the app would be a good addition.

Any suggestions/ feedback?
I'd be more than happy to provide a pull request later on!

Cheers, Raphael