adding config option to enable/disable baked-in turtl webapp to api (previously, was always on). this is BAD in production because the webapp is insecure.
Merge branch 'master' into files