Application settings

Central runtime controls. Disabling a protected feature is enforced by the backend, not only hidden in the client.