render app-add-wizard config form slightly nicer
apply the same loopback-and-anyone-login logic
(as 8f99f5dde120f780e885532884d5c0e509358f4d,
(as 8f99f5dde120f780e885532884d5c0e509358f4d, ie when no security is specified)
in other places/configurations
correct spelling, add javadoc, for EffectorParam