add "login all URLs" configuration option

Prior to this change, the plugin's filter acted on all URLs. This meant
that users were logged in right away. This also meant that it was
impossible to log out, or to grant anonymous users any effective level
of access (authentication was effectively mandatory).

Add a new "login all URLs" configuration option. This makes "log in"
work similarly to the OpenID plugin - users have to click "log in", the
"log out" button works, and administrators have the option of granting
access to anonymous users.