prevent crashing with no configured superusers
only allow superusers to configure users and permissions
ask for a session secret on initialize
don't prompt for initial user setup with third-party passport auth