[All] Stop allowing all authenticated users by default

[consideRatio]

Our authenticators default to allowing all authenticated users if no set of allowed users are configured.

I think this default should change to not allow all authenticated users in those situations. At the same time, it should be possible to allow all authenticated users.

To accomplish this, I suggest we don't allow any user unless explicitly allowed by some config, and then also introduce the allow_all config defaulting to False, allowing all users to be allowed.

Related

• This is a practical proposal on how to address Discussion: don't default to allowing all users? #609
• This is a practical proposal in line with the idea for adding allow_all config in the Authenticator base class, Authenticator config to toggle allowing users by default (when no other allow config is specified) jupyterhub#4484

[manics]

#609