allow whitelist and authenticated-gets to be configured by user

This pr would have to be pulled with the authenticated-gets pr on the unpm repo.

This allows the end user a little more control of what is allowed on their private npm repo. It allows anon gets to be disabled, and them to alter the whitelist of routes.