Features/uncid 146 user login disable

This change disables /user/password and /user/login paths by default, and this behavior can be overridden by setting the 'hid_auth_login_enabled' system variable to TRUE using 'drush vset hid_auth_login_enabled 1' or using the admin UI at /admin/config/services/hid_auth. This also disables the user login form at /user, but will still display the user page for a logged-in user.