Force specific straight.plugin version

straight.plugin 1.4.0 has a critical bug and the bugfix release was made
with a very strange version number which pip doesn't recognise as newer
than 1.4.0.
Some initial permissions for the auth system