Changes to default settings for LMS as recommended by Matasano

These settings were required for a private fork after a 3rd party security review. It was desired to have the default settings be more secure by default, and let other environments (e.g. devstack.py) override the settings if they desire lower levels of security.

We may decide that this is unnecessary for main edx-platform, but worth considering. Thus this review starts the conversation.
Please update the comment above this line.