add paranoid mode

[bsmt]

Some features or conveniences aren't available because of configuration in the name of security. The irony of that is not lost on me. If you're deploying on a server accessible via the internet, that makes sense. But, if you're just running it in a VM on your machine, you really don't need to password protect every single thing. So, I think it would be a good idea to add a default['base']['paranoid'] option, or something.