allow api-session-auth feature flag to be set

[pdurbin]

There's a new feature flag called api-session-auth that I'd like to set to "true" or "1" so that the SPA can log in to the backend: http://preview.guides.gdcc.io/en/develop/installation/config.html#feature-flags

It should definitely be unset or explicitly off by default, because it's a potential security risk. (This is just for demos until we have bearer token support for the backend and the frontend.)

Please let me know if we can add this. Thanks! ❤️

[donsizemore]

@pdurbin would also like api-bearer-auth to be available. renaming the branch to 279_feature_flags and adding these two. per a conversation with Phil I'll keep these as simple JVM options for now, once there are more and the configuration solidifies I'll convert the calls to whatever the preferred way is at that time.