nodes: use nopasswd sudo on offsite

offsite won't have kerberos available, so passwords won't do.
common/auth: add option to skip Kerberos

This allows the offsite server to not use Kerberos, since firestorm will
be unavailable.

I'm similarly disabling access to firestorm from offsite now so that we
(hopefully) notice any problems early.