Add app.isAuthEnabled.

The flag is set by `app.enableAuth` and can be used to detect
whether the access control is enabled.