Actually, I wonder if we should also add the functionality to explicitly override per-application security configs. It seems like a simple change: if the HistoryServer sets `spark.ui.acls.*`, then ignore appListener's security options.

What do you think?