Allow tokens to be disabled

Problem/Motivation

In the vast majority of sites, webform is configured by administrators, who set up the module and create the webform nodes. Since the 3.x branch, these administrators have had access to tokens to use for default values, e-mail messages, and other uses. There are a small set of use cases, however, where an administrator might set up webform, but less trusted users actually create the webform nodes.

Proposed resolution

To support these configurations, it would be helpful to disable tokens to prevent inadvertently letting these semi-trusted users gaining access to data via tokens.

User interface changes

A global webform configuration setting to turn off token support.