Disable `tokenhosts` feature by default

With the advent of challenge-response authentication, the `tokenhosts`
feature is no longer necessary. It can still be used for slightly
increased security, but since it makes it harder for users to get
the server up and running, it is now disabled by default.