registration can be disabled

- add Squash::Configuration.authentication.registration_enabled
- add simple test for the registration disabled case