Renamed configuration parameter to enable_renewals
broadened restrictions to all roles except superuse