feature: allow passwordless authentication to Tracker Tracker

[bitglows]

I'm using forward auth in my reverse proxy, so authentication in the app itself is unnecessary. Most apps have an environment var that disables auth entirely, would be nice (with tons of warnings etc.)