By default, don't render the config vars debug panel

Summary:
We could allow the config vars based on logged in or admin status, but they're rarely useful, and if we want
them there are other ways.
Sadly, this seemed to be the cleanest way to exclude only a single panel.

Test Plan: Manual, oh so manual.

Reviewers: josiah

Reviewed By: josiah

Subscribers: changesbot

Differential Revision: https://tails.corp.dropbox.com/D220332

changes/config.py

@@ -241,6 +241,17 @@ def create_app(_read_config=True, **config):
 
     app.config['DEBUG_TB_ENABLED'] = True
 
+    app.config['DEBUG_TB_PANELS'] = ('flask_debugtoolbar.panels.versions.VersionDebugPanel',
+                                     'flask_debugtoolbar.panels.timer.TimerDebugPanel',
+                                     'flask_debugtoolbar.panels.headers.HeaderDebugPanel',
+                                     'flask_debugtoolbar.panels.request_vars.RequestVarsDebugPanel',
+                                     # Disable the config vars panel by default; it can contain sensitive information.
+                                     # 'flask_debugtoolbar.panels.config_vars.ConfigVarsDebugPanel',
+                                     'flask_debugtoolbar.panels.template.TemplateDebugPanel',
+                                     'flask_debugtoolbar.panels.sqlalchemy.SQLAlchemyDebugPanel',
+                                     'flask_debugtoolbar.panels.logger.LoggingPanel',
+                                     'flask_debugtoolbar.panels.profiler.ProfilerDebugPanel')
+
     # celerybeat must be running for our cleanup tasks to execute
     # e.g. celery worker -B
     app.config['CELERYBEAT_SCHEDULE'] = {