Add a new API that controls whether a user is allowed to authenticate. (#1197)