Move Public API behind labs flag

closes #5941
- added UI to labs page
- added method to determine if full authentication is required
- updated public_api tests to enable public api first

ghost/admin/app/controllers/feature.js

@@ -25,5 +25,9 @@ export default Ember.Controller.extend(Ember.PromiseProxyMixin, {
         }
 
         return value;
+    }),
+
+    publicAPI: Ember.computed('config.publicAPI', 'labs.publicAPI', function () {
+        return this.get('config.publicAPI') || this.get('labs.publicAPI');
     })
 });

ghost/admin/app/controllers/settings/labs.js

@@ -9,6 +9,7 @@ export default Ember.Controller.extend({
     ghostPaths: Ember.inject.service('ghost-paths'),
     notifications: Ember.inject.service(),
     session: Ember.inject.service(),
+    feature: Ember.inject.controller(),
 
     labsJSON: Ember.computed('model.labs', function () {
         return JSON.parse(this.get('model.labs') || {});
@@ -29,6 +30,16 @@ export default Ember.Controller.extend({
         });
     },
 
+    usePublicAPI: Ember.computed('feature.publicAPI', {
+        get: function () {
+            return this.get('feature.publicAPI');
+        },
+        set: function (key, value) {
+            this.saveLabs('publicAPI', value);
+            return value;
+        }
+    }),
+
     actions: {
         onUpload: function (file) {
             var self = this,

ghost/admin/app/templates/settings/labs.hbs

@@ -42,5 +42,19 @@
                 </div>
             </fieldset>
         </form>
+        <hr>
+        <form>
+            <fieldset>
+                <div class="form-group for-checkbox">
+                    <label for="labs-publicAPI">Public API</label>
+                    <label class="checkbox" for="labs-publicAPI">
+                        {{input id="labs-publicAPI" name="labs[publicAPI]" type="checkbox" checked=usePublicAPI}}
+                        <span class="input-toggle-component"></span>
+                        <p>Enable public API access.</p>
+                    </label>
+                    <p>Allow access to the publicly available Ghost API using JavaScript.</p>
+                </div>
+            </fieldset>
+        </form>
     </section>
 </section>