enhancement(metrics): allow disabling via config option

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/web/statusRouter.js

@@ -24,6 +24,9 @@ statusRouter.get('/_health', function (req, res) {
 
 // get status
 statusRouter.get('/status', function (req, res, next) {
+  if (!config.enableStatsApi) {
+    return errors.errorForbidden(res)
+  }
   realtime.getStatus(function (data) {
     res.set({
       'Cache-Control': 'private', // only cache by client