Make configuration API only available to jury and limit submissions output to valid ones.

The amount of info available through the configuration variables may not
be stellar, but it's not always published in another form, so limit access
to prevent surprises.

For submissions, it makes sense not to include invalidated submissions
by default. If someone has a usecase for getting those, we can add an extra
query parameter.