We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Explain in the doc how to disable default_buckets and bucket creation from authenticated users.
From a discussion with @chrismbeckett on IRC:

1) Anyone can register for my application and get an auth token that allows them to login to Kinto. With personal buckets, someone could figure out how to start storing anything they want. I am concerned I may need to _turn off_ personal buckets since they may be a security risk.

2) Same for buckets. I am probably going to lock down creating buckets so it is done by my auth server when an account is created.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `kinto/__init__.py`
Content:
```
1 import pkg_resources
2 import logging
3 
4 import cliquet
5 from pyramid.config import Configurator
6 from pyramid.settings import asbool
7 from pyramid.security import Authenticated
8 
9 from kinto.authorization import RouteFactory
10 
11 # Module version, as defined in PEP-0396.
12 __version__ = pkg_resources.get_distribution(__package__).version
13 
14 # Implemented HTTP API Version
15 HTTP_API_VERSION = '1.4'
16 
17 # Main kinto logger
18 logger = logging.getLogger(__name__)
19 
20 
21 DEFAULT_SETTINGS = {
22     'retry_after_seconds': 3,
23     'cache_backend': 'cliquet.cache.memory',
24     'permission_backend': 'cliquet.permission.memory',
25     'storage_backend': 'cliquet.storage.memory',
26     'project_docs': 'https://kinto.readthedocs.org/',
27     'bucket_create_principals': Authenticated,
28     'multiauth.authorization_policy': (
29         'kinto.authorization.AuthorizationPolicy'),
30     'experimental_collection_schema_validation': 'False',
31     'http_api_version': HTTP_API_VERSION
32 }
33 
34 
35 def main(global_config, config=None, **settings):
36     if not config:
37         config = Configurator(settings=settings, root_factory=RouteFactory)
38 
39     # Force project name, since it determines settings prefix.
40     config.add_settings({'cliquet.project_name': 'kinto'})
41 
42     cliquet.initialize(config,
43                        version=__version__,
44                        default_settings=DEFAULT_SETTINGS)
45 
46     settings = config.get_settings()
47 
48     # In Kinto API 1.x, a default bucket is available.
49     # Force its inclusion if not specified in settings.
50     if 'kinto.plugins.default_bucket' not in settings['includes']:
51         config.include('kinto.plugins.default_bucket')
52 
53     # Retro-compatibility with first Kinto clients.
54     config.registry.public_settings.add('cliquet.batch_max_requests')
55 
56     # Expose capability
57     schema_enabled = asbool(
58         settings['experimental_collection_schema_validation']
59     )
60     if schema_enabled:
61         config.add_api_capability(
62             "schema",
63             description="Validates collection records with JSON schemas.",
64             url="http://kinto.readthedocs.org/en/latest/api/1.x/"
65                 "collections.html#collection-json-schema")
66 
67     # Scan Kinto views.
68     kwargs = {}
69     flush_enabled = asbool(settings.get('flush_endpoint_enabled'))
70 
71     if flush_enabled:
72         config.add_api_capability(
73             "flush_endpoint",
74             description="The __flush__ endpoint can be used to remove all "
75                         "data from all backends.",
76             url="http://kinto.readthedocs.org/en/latest/configuration/"
77                 "settings.html#activating-the-flush-endpoint"
78         )
79     else:
80         kwargs['ignore'] = 'kinto.views.flush'
81     config.scan("kinto.views", **kwargs)
82 
83     app = config.make_wsgi_app()
84 
85     # Install middleware (idempotent if disabled)
86     return cliquet.install_middlewares(app, settings)
87
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/kinto/__init__.py b/kinto/__init__.py
--- a/kinto/__init__.py
+++ b/kinto/__init__.py
@@ -45,11 +45,6 @@
 
     settings = config.get_settings()
 
-    # In Kinto API 1.x, a default bucket is available.
-    # Force its inclusion if not specified in settings.
-    if 'kinto.plugins.default_bucket' not in settings['includes']:
-        config.include('kinto.plugins.default_bucket')
-
     # Retro-compatibility with first Kinto clients.
     config.registry.public_settings.add('cliquet.batch_max_requests')

{"golden_diff": "diff --git a/kinto/__init__.py b/kinto/__init__.py\n--- a/kinto/__init__.py\n+++ b/kinto/__init__.py\n@@ -45,11 +45,6 @@\n \n     settings = config.get_settings()\n \n-    # In Kinto API 1.x, a default bucket is available.\n-    # Force its inclusion if not specified in settings.\n-    if 'kinto.plugins.default_bucket' not in settings['includes']:\n-        config.include('kinto.plugins.default_bucket')\n-\n     # Retro-compatibility with first Kinto clients.\n     config.registry.public_settings.add('cliquet.batch_max_requests')\n", "issue": "Explain in the doc how to disable default_buckets and bucket creation from authenticated users.\nFrom a discussion with @chrismbeckett on IRC:\n\n1) Anyone can register for my application and get an auth token that allows them to login to Kinto. With personal buckets, someone could figure out how to start storing anything they want. I am concerned I may need to _turn off_ personal buckets since they may be a security risk.\n\n2) Same for buckets. I am probably going to lock down creating buckets so it is done by my auth server when an account is created.\n\n", "before_files": [{"content": "import pkg_resources\nimport logging\n\nimport cliquet\nfrom pyramid.config import Configurator\nfrom pyramid.settings import asbool\nfrom pyramid.security import Authenticated\n\nfrom kinto.authorization import RouteFactory\n\n# Module version, as defined in PEP-0396.\n__version__ = pkg_resources.get_distribution(__package__).version\n\n# Implemented HTTP API Version\nHTTP_API_VERSION = '1.4'\n\n# Main kinto logger\nlogger = logging.getLogger(__name__)\n\n\nDEFAULT_SETTINGS = {\n    'retry_after_seconds': 3,\n    'cache_backend': 'cliquet.cache.memory',\n    'permission_backend': 'cliquet.permission.memory',\n    'storage_backend': 'cliquet.storage.memory',\n    'project_docs': 'https://kinto.readthedocs.org/',\n    'bucket_create_principals': Authenticated,\n    'multiauth.authorization_policy': (\n        'kinto.authorization.AuthorizationPolicy'),\n    'experimental_collection_schema_validation': 'False',\n    'http_api_version': HTTP_API_VERSION\n}\n\n\ndef main(global_config, config=None, **settings):\n    if not config:\n        config = Configurator(settings=settings, root_factory=RouteFactory)\n\n    # Force project name, since it determines settings prefix.\n    config.add_settings({'cliquet.project_name': 'kinto'})\n\n    cliquet.initialize(config,\n                       version=__version__,\n                       default_settings=DEFAULT_SETTINGS)\n\n    settings = config.get_settings()\n\n    # In Kinto API 1.x, a default bucket is available.\n    # Force its inclusion if not specified in settings.\n    if 'kinto.plugins.default_bucket' not in settings['includes']:\n        config.include('kinto.plugins.default_bucket')\n\n    # Retro-compatibility with first Kinto clients.\n    config.registry.public_settings.add('cliquet.batch_max_requests')\n\n    # Expose capability\n    schema_enabled = asbool(\n        settings['experimental_collection_schema_validation']\n    )\n    if schema_enabled:\n        config.add_api_capability(\n            \"schema\",\n            description=\"Validates collection records with JSON schemas.\",\n            url=\"http://kinto.readthedocs.org/en/latest/api/1.x/\"\n                \"collections.html#collection-json-schema\")\n\n    # Scan Kinto views.\n    kwargs = {}\n    flush_enabled = asbool(settings.get('flush_endpoint_enabled'))\n\n    if flush_enabled:\n        config.add_api_capability(\n            \"flush_endpoint\",\n            description=\"The __flush__ endpoint can be used to remove all \"\n                        \"data from all backends.\",\n            url=\"http://kinto.readthedocs.org/en/latest/configuration/\"\n                \"settings.html#activating-the-flush-endpoint\"\n        )\n    else:\n        kwargs['ignore'] = 'kinto.views.flush'\n    config.scan(\"kinto.views\", **kwargs)\n\n    app = config.make_wsgi_app()\n\n    # Install middleware (idempotent if disabled)\n    return cliquet.install_middlewares(app, settings)\n", "path": "kinto/__init__.py"}], "after_files": [{"content": "import pkg_resources\nimport logging\n\nimport cliquet\nfrom pyramid.config import Configurator\nfrom pyramid.settings import asbool\nfrom pyramid.security import Authenticated\n\nfrom kinto.authorization import RouteFactory\n\n# Module version, as defined in PEP-0396.\n__version__ = pkg_resources.get_distribution(__package__).version\n\n# Implemented HTTP API Version\nHTTP_API_VERSION = '1.4'\n\n# Main kinto logger\nlogger = logging.getLogger(__name__)\n\n\nDEFAULT_SETTINGS = {\n    'retry_after_seconds': 3,\n    'cache_backend': 'cliquet.cache.memory',\n    'permission_backend': 'cliquet.permission.memory',\n    'storage_backend': 'cliquet.storage.memory',\n    'project_docs': 'https://kinto.readthedocs.org/',\n    'bucket_create_principals': Authenticated,\n    'multiauth.authorization_policy': (\n        'kinto.authorization.AuthorizationPolicy'),\n    'experimental_collection_schema_validation': 'False',\n    'http_api_version': HTTP_API_VERSION\n}\n\n\ndef main(global_config, config=None, **settings):\n    if not config:\n        config = Configurator(settings=settings, root_factory=RouteFactory)\n\n    # Force project name, since it determines settings prefix.\n    config.add_settings({'cliquet.project_name': 'kinto'})\n\n    cliquet.initialize(config,\n                       version=__version__,\n                       default_settings=DEFAULT_SETTINGS)\n\n    settings = config.get_settings()\n\n    # Retro-compatibility with first Kinto clients.\n    config.registry.public_settings.add('cliquet.batch_max_requests')\n\n    # Expose capability\n    schema_enabled = asbool(\n        settings['experimental_collection_schema_validation']\n    )\n    if schema_enabled:\n        config.add_api_capability(\n            \"schema\",\n            description=\"Validates collection records with JSON schemas.\",\n            url=\"http://kinto.readthedocs.org/en/latest/api/1.x/\"\n                \"collections.html#collection-json-schema\")\n\n    # Scan Kinto views.\n    kwargs = {}\n    flush_enabled = asbool(settings.get('flush_endpoint_enabled'))\n\n    if flush_enabled:\n        config.add_api_capability(\n            \"flush_endpoint\",\n            description=\"The __flush__ endpoint can be used to remove all \"\n                        \"data from all backends.\",\n            url=\"http://kinto.readthedocs.org/en/latest/configuration/\"\n                \"settings.html#activating-the-flush-endpoint\"\n        )\n    else:\n        kwargs['ignore'] = 'kinto.views.flush'\n    config.scan(\"kinto.views\", **kwargs)\n\n    app = config.make_wsgi_app()\n\n    # Install middleware (idempotent if disabled)\n    return cliquet.install_middlewares(app, settings)\n", "path": "kinto/__init__.py"}]}