Add app.isAuthEnabled.

The flag is set by `app.enableAuth` and can be used to detect whether the access control is enabled.

This is another follow-up for #167. I am planning to use this flag in loopback-explorer to decide whether the swagger descriptors should include `authorizations`.

/to @raymondfeng or @ritch please review.