* Add has-user-setup setting

- iff no user is setup aka has-user-setup == false, then redirect to /setup
- when set from the env variable the setup-token is completely
  immutable, so can remove clear-token!

* make /api/setup only setup accounts when not has-user-setup

- react router changes to respect 'has-user-setup' setting

- include docstring for print-setup-url

* allow tests to setup multiple users via POST /api/setup

* remove unused function hasSetupToken

* Adds a test to enforce a single creation only

- we now throw an ex-info with status-code 403 when has-user-setup and
  /api/setup route is hit (with error message mentioning the route)
- more code review responses

- fixup test to not delete users, (or set locale to spanish...)

* addressing code review concerns

- *disallow... -> *allow... for the dynamic var name
- has-user-settings test: do not assume the test db has users in it
- update test