config.def.h: add an option allowwindowops, by default off (secure)