Let only admins change the global settings

BINDERY_ADMIN_USERS lists the admins of the cwa and proxy modes. Only an
admin can change the global settings and the global rules, and read or
change personal.ini. Without a list, each user is an admin.

tests/test_config.py

@@ -69,6 +69,7 @@ def test_values_from_the_environment(monkeypatch, reload_config):
     monkeypatch.setenv("UPDATE_INTERVAL_HOURS", "1.5")
     monkeypatch.setenv("DEFAULT_LOCKED_FIELDS", "title, authors")
     monkeypatch.setenv("CWA_ALLOWED_USERS", "alice,bob")
+    monkeypatch.setenv("BINDERY_ADMIN_USERS", "alice")
     monkeypatch.setenv("CONFIG_DIR", "/data/bindery")
     monkeypatch.setenv("TRUST_PROXY", "yes")
     monkeypatch.setenv("CWA_DB_PATH", " /cwa/app.db ")
@@ -83,6 +84,7 @@ def test_values_from_the_environment(monkeypatch, reload_config):
     assert config.UPDATE_INTERVAL_HOURS == 1.5
     assert config.DEFAULT_LOCKED_FIELDS == ["title", "authors"]
     assert config.CWA_ALLOWED_USERS == ["alice", "bob"]
+    assert config.ADMIN_USERS == ["alice"]
     assert str(config.DB_PATH) == "/data/bindery/bindery.db"
     assert config.TRUST_PROXY is True
     assert str(config.CWA_DB_PATH) == "/cwa/app.db"
@@ -101,6 +103,7 @@ def test_defaults(monkeypatch, reload_config):
         "PROXY_AUTH_USER_HEADER",
         "PROXY_AUTH_TRUSTED_IPS",
         "ALLOWED_HOSTS",
+        "BINDERY_ADMIN_USERS",
         "SESSION_COOKIE_SECURE",
         "TRUST_PROXY",
         "CWA_DB_PATH",
@@ -127,6 +130,7 @@ def test_defaults(monkeypatch, reload_config):
         "fe80::/10",
     ]
     assert config.ALLOWED_HOSTS == []
+    assert config.ADMIN_USERS == []
     assert config.SESSION_COOKIE_SECURE is False
     assert config.TRUST_PROXY is False
     assert config.CWA_DB_PATH is None