disable remote embedding by default

lib/env.js

@@ -153,6 +153,9 @@ module.exports.create = function (config) {
             }
         },
 
+        // as of 4.14.0 you need to opt-in to remote embedding.
+        disableEmbedding: true,
+
 /*  FIXME restrictRegistration is initialized as false and then overridden by admin decree
     There is a narrow window in which someone could register before the server updates this value.
     See also the cached 'restrictRegistration' value in server.js#serveConfig