add ckan.auth.create_user option (default true) which when set to false prevents all new user registrations (via site and API), which is useful in a locked-down publisher mode