add "login all URLs" configuration option

Prior to this change, the plugin's filter acted on all URLs. This meant that users were logged in right away. This also meant that it was impossible to log out, or to grant anonymous users any effective level of access (authentication was effectively mandatory).

Add a new "login all URLs" configuration option. This makes "log in" work similarly to the OpenID plugin:

- users have to click "log in",
- the "log out" button works,
- administrators have the option of granting access to anonymous users.