diff --git a/src/applications/config/option/PhabricatorAWSConfigOptions.php b/src/applications/config/option/PhabricatorAWSConfigOptions.php
index a8e3bced1c..88042c410c 100644
--- a/src/applications/config/option/PhabricatorAWSConfigOptions.php
+++ b/src/applications/config/option/PhabricatorAWSConfigOptions.php
@@ -1,41 +1,45 @@
 <?php
 
 final class PhabricatorAWSConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Amazon Web Services");
   }
 
   public function getDescription() {
     return pht("Configure integration with AWS (EC2, SES, S3, etc).");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('amazon-ses.access-key', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('Access key for Amazon SES.')),
       $this->newOption('amazon-ses.secret-key', 'string', null)
         ->setMasked(true)
         ->setDescription(pht('Secret key for Amazon SES.')),
       $this->newOption('amazon-s3.access-key', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('Access key for Amazon S3.')),
       $this->newOption('amazon-s3.secret-key', 'string', null)
         ->setMasked(true)
         ->setDescription(pht('Secret key for Amazon S3.')),
       $this->newOption('amazon-s3.endpoint', 'string', null)
+        ->setLocked(true)
         ->setDescription(
           pht(
             'Explicit S3 endpoint to use. Leave empty to have Phabricator '.
             'select and endpoint. Normally, you do not need to set this.'))
         ->addExample(null, 'Use default endpoint')
         ->addExample('s3.amazon.com', 'Use specific endpoint'),
       $this->newOption('amazon-ec2.access-key', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('Access key for Amazon EC2.')),
       $this->newOption('amazon-ec2.secret-key', 'string', null)
         ->setMasked(true)
         ->setDescription(pht('Secret key for Amazon EC2.')),
     );
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorCoreConfigOptions.php b/src/applications/config/option/PhabricatorCoreConfigOptions.php
index d492a3b715..184def1554 100644
--- a/src/applications/config/option/PhabricatorCoreConfigOptions.php
+++ b/src/applications/config/option/PhabricatorCoreConfigOptions.php
@@ -1,250 +1,254 @@
 <?php
 
 final class PhabricatorCoreConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Core");
   }
 
   public function getDescription() {
     return pht("Configure core options, including URIs.");
   }
 
   public function getOptions() {
     if (phutil_is_windows()) {
       $paths = array();
     } else {
       $paths = array(
         '/bin',
         '/usr/bin',
         '/usr/local/bin',
       );
     }
 
     $path = getenv('PATH');
 
     return array(
       $this->newOption('phabricator.base-uri', 'string', null)
         ->setLocked(true)
         ->setSummary(pht("URI where Phabricator is installed."))
         ->setDescription(
           pht(
             "Set the URI where Phabricator is installed. Setting this ".
             "improves security by preventing cookies from being set on other ".
             "domains, and allows daemons to send emails with links that have ".
             "the correct domain."))
         ->addExample('http://phabricator.example.com/', pht('Valid Setting')),
       $this->newOption('phabricator.production-uri', 'string', null)
         ->setSummary(
           pht("Primary install URI, for multi-environment installs."))
         ->setDescription(
           pht(
             "If you have multiple Phabricator environments (like a ".
             "development/staging environment for working on testing ".
             "Phabricator, and a production environment for deploying it), ".
             "set the production environment URI here so that emails and other ".
             "durable URIs will always generate with links pointing at the ".
             "production environment. If unset, defaults to ".
             "{{phabricator.base-uri}}. Most installs do not need to set ".
             "this option."))
         ->addExample('http://phabricator.example.com/', pht('Valid Setting')),
       $this->newOption('phabricator.allowed-uris', 'list<string>', array())
         ->setLocked(true)
         ->setSummary(pht("Alternative URIs that can access Phabricator."))
         ->setDescription(
           pht(
             "These alternative URIs will be able to access 'normal' pages ".
               "on your Phabricator install. Other features such as OAuth ".
               "won't work. The major use case for this is moving installs ".
               "across domains."))
         ->addExample(
           "http://phabricator2.example.com/\n".
           "http://phabricator3.example.com/",
           pht('Valid Setting')),
       $this->newOption('phabricator.timezone', 'string', null)
         ->setSummary(
           pht("The timezone Phabricator should use."))
         ->setDescription(
           pht(
             "PHP requires that you set a timezone in your php.ini before ".
             "using date functions, or it will emit a warning. If this isn't ".
             "possible (for instance, because you are using HPHP) you can set ".
             "some valid constant for date_default_timezone_set() here and ".
             "Phabricator will set it on your behalf, silencing the warning."))
         ->addExample('America/New_York', pht('US East (EDT)'))
         ->addExample('America/Chicago', pht('US Central (CDT)'))
         ->addExample('America/Boise', pht('US Mountain (MDT)'))
         ->addExample('America/Los_Angeles', pht('US West (PDT)')),
       $this->newOption('phabricator.cookie-prefix', 'string', null)
         ->setSummary(
           pht("Set a string Phabricator should use to prefix ".
               "cookie names"))
         ->setDescription(
           pht(
             "Cookies set for x.com are also sent for y.x.com. Assuming ".
             "Phabricator instances are running on both domains, this will ".
             "create a collision preventing you from logging in."))
         ->addExample('dev', pht('Prefix cookie with "dev"')),
       $this->newOption('phabricator.show-beta-applications', 'bool', false)
         ->setBoolOptions(
           array(
             pht('Install Beta Applications'),
             pht('Uninstall Beta Applications')
           ))
+        ->setSummary(
+          pht(
+            'Install applications which are still under development.'))
         ->setDescription(
           pht(
             "Phabricator includes 'Beta' applications which are in an early ".
             "stage of development. They range from very rough prototypes to ".
             "relatively complete (but unpolished) applications.\n\n".
             "By default, Beta applications are not installed. You can enable ".
             "this option to install them if you're interested in previewing ".
             "upcoming features.\n\n".
             "After enabling Beta applications, you can selectively uninstall ".
             "them (like normal applications).")),
       $this->newOption('phabricator.serious-business', 'bool', false)
         ->setBoolOptions(
           array(
             pht('Serious business'),
             pht('Shenanigans'), // That should be interesting to translate. :P
           ))
         ->setSummary(
-          pht("Should Phabricator be serious?"))
+          pht("Allows you to remove levity and jokes from the UI."))
         ->setDescription(
           pht(
             'By default, Phabricator includes some flavor text in the UI, '.
             'like a prompt to "Weigh In" rather than "Add Comment" in '.
             'Maniphest. If you\'d prefer more traditional UI strings like '.
             '"Add Comment", you can set this flag to disable most of the '.
             'extra flavor.')),
        $this->newOption('environment.append-paths', 'list<string>', $paths)
         ->setSummary(
           pht("These paths get appended to your \$PATH envrionment variable."))
         ->setDescription(
           pht(
             "Phabricator occasionally shells out to other binaries on the ".
             "server. An example of this is the `pygmentize` command, used ".
             "to syntax-highlight code written in languages other than PHP. ".
             "By default, it is assumed that these binaries are in the \$PATH ".
             "of the user running Phabricator (normally 'apache', 'httpd', or ".
             "'nobody'). Here you can add extra directories to the \$PATH ".
             "environment variable, for when these binaries are in ".
             "non-standard locations.\n\n".
             "Note that you can also put binaries in ".
             "`phabricator/support/bin/` (for example, by symlinking them).\n\n".
             "The current value of PATH after configuration is applied is:\n\n".
             "  lang=text\n".
             "  %s", $path))
+        ->setLocked(true)
         ->addExample('/usr/local/bin', pht('Add One Path'))
         ->addExample("/usr/bin\n/usr/local/bin", pht('Add Multiple Paths')),
       $this->newOption('config.lock', 'set', array())
         ->setLocked(true)
         ->setDescription(pht('Additional configuration options to lock.')),
       $this->newOption('config.hide', 'set', array())
         ->setLocked(true)
         ->setDescription(pht('Additional configuration options to hide.')),
       $this->newOption('config.mask', 'set', array())
         ->setLocked(true)
         ->setDescription(pht('Additional configuration options to mask.')),
       $this->newOption('config.ignore-issues', 'set', array())
         ->setLocked(true)
         ->setDescription(pht('Setup issues to ignore.')),
       $this->newOption('phabricator.env', 'string', null)
         ->setLocked(true)
         ->setDescription(pht('Internal.')),
       $this->newOption('test.value', 'wild', null)
         ->setLocked(true)
         ->setDescription(pht('Unit test value.')),
       $this->newOption('phabricator.uninstalled-applications', 'set', array())
         ->setLocked(true)
         ->setDescription(
           pht('Array containing list of Uninstalled applications.')),
       $this->newOption('phabricator.application-settings', 'wild', array())
         ->setLocked(true)
         ->setDescription(
           pht('Customized settings for Phabricator applications.')),
       $this->newOption('welcome.html', 'string', null)
         ->setLocked(true)
         ->setDescription(
           pht('Custom HTML to show on the main Phabricator dashboard.')),
       $this->newOption('phabricator.cache-namespace', 'string', null)
         ->setLocked(true)
         ->setDescription(pht('Cache namespace.')),
       $this->newOption('phabricator.allow-email-users', 'bool', false)
         ->setBoolOptions(
             array(
               pht('Allow'),
               pht('Disallow'),
               ))->setDescription(
                  pht(
                    'Allow non-members to interact with tasks over email.')),
       );
 
   }
 
   protected function didValidateOption(
     PhabricatorConfigOption $option,
     $value) {
 
     $key = $option->getKey();
     if ($key == 'phabricator.base-uri' ||
         $key == 'phabricator.production-uri') {
 
       $uri = new PhutilURI($value);
       $protocol = $uri->getProtocol();
       if ($protocol !== 'http' && $protocol !== 'https') {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must start with ".
             "'http://' or 'https://'.",
             $key));
       }
 
       $domain = $uri->getDomain();
       if (strpos($domain, '.') === false) {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must contain a dot ('.'), ".
             "like 'http://example.com/', not just a bare name like ".
             "'http://example/'. Some web browsers will not set cookies on ".
             "domains with no TLD.",
             $key));
       }
 
       $path = $uri->getPath();
       if ($path !== '' && $path !== '/') {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must NOT have a path, ".
             "e.g. 'http://phabricator.example.com/' is OK, but ".
             "'http://example.com/phabricator/' is not. Phabricator must be ".
             "installed on an entire domain; it can not be installed on a ".
             "path.",
             $key));
       }
     }
 
 
     if ($key === 'phabricator.timezone') {
       $old = date_default_timezone_get();
       $ok = @date_default_timezone_set($value);
       @date_default_timezone_set($old);
 
       if (!$ok) {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The timezone identifier must ".
             "be a valid timezone identifier recognized by PHP, like ".
             "'America/Los_Angeles'. You can find a list of valid identifiers ".
             "here: %s",
             $key,
             'http://php.net/manual/timezones.php'));
       }
     }
 
 
 
   }
 
 
 }
diff --git a/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php b/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
index aa8ea620f6..3c6678cf2f 100644
--- a/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
+++ b/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
@@ -1,41 +1,42 @@
 <?php
 
 final class PhabricatorExtendingPhabricatorConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Extending Phabricator");
   }
 
   public function getDescription() {
     return pht("Make Phabricator even cooler!");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('load-libraries', 'list<string>', array())
         ->setLocked(true)
         ->setSummary(pht("Paths to additional phutil libraries to load."))
         ->addExample('/srv/our-libs/sekrit-phutil', pht('Valid Setting')),
       $this->newOption('events.listeners', 'list<string>', array())
         ->setLocked(true)
         ->setSummary(
           pht("Listeners receive callbacks when interesting things occur."))
         ->setDescription(
           pht(
             "You can respond to various application events by installing ".
             "listeners, which will receive callbacks when interesting things ".
             "occur. Specify a list of classes which extend ".
             "PhabricatorEventListener here."))
         ->addExample('MyEventListener', pht('Valid Setting')),
        $this->newOption(
          'aphront.default-application-configuration-class',
          'class',
          'AphrontDefaultApplicationConfiguration')
+        ->setLocked(true)
         ->setBaseClass('AphrontApplicationConfiguration')
         // TODO: This could probably use some better documentation.
         ->setDescription(pht("Application configuration class.")),
     );
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorMailgunConfigOptions.php b/src/applications/config/option/PhabricatorMailgunConfigOptions.php
index cc4fb56d6d..7c5b629227 100644
--- a/src/applications/config/option/PhabricatorMailgunConfigOptions.php
+++ b/src/applications/config/option/PhabricatorMailgunConfigOptions.php
@@ -1,28 +1,29 @@
 <?php
 
 final class PhabricatorMailgunConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Integration with Mailgun");
   }
 
   public function getDescription() {
     return pht("Configure Mailgun integration.");
   }
 
   public function getOptions() {
     return array(
-      $this->newOption('mailgun.api-key', 'string', null)
-        ->setMasked(true)
-        ->setDescription(pht('Mailgun API key.')),
       $this->newOption('mailgun.domain', 'string', null)
+        ->setLocked(true)
         ->setDescription(
           pht(
             'Mailgun domain name. See https://mailgun.com/cp/domains'))
         ->addExample('mycompany.com', 'Use specific domain'),
+      $this->newOption('mailgun.api-key', 'string', null)
+        ->setMasked(true)
+        ->setDescription(pht('Mailgun API key.')),
     );
 
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorPHDConfigOptions.php b/src/applications/config/option/PhabricatorPHDConfigOptions.php
index 934684b91b..a15844f4d2 100644
--- a/src/applications/config/option/PhabricatorPHDConfigOptions.php
+++ b/src/applications/config/option/PhabricatorPHDConfigOptions.php
@@ -1,68 +1,69 @@
 <?php
 
 final class PhabricatorPHDConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Daemons");
   }
 
   public function getDescription() {
     return pht("Options relating to PHD (daemons).");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('phd.pid-directory', 'string', '/var/tmp/phd/pid')
         ->setDescription(
           pht(
             "Directory that phd should use to track running daemons.")),
       $this->newOption('phd.log-directory', 'string', '/var/tmp/phd/log')
         ->setDescription(
           pht(
             "Directory that the daemons should use to store log files.")),
       $this->newOption('phd.start-taskmasters', 'int', 4)
         ->setSummary(pht("Number of TaskMaster daemons to start by default."))
         ->setDescription(
           pht(
             "Number of 'TaskMaster' daemons that 'phd start' should start. ".
             "You can raise this if you have a task backlog, or explicitly ".
             "launch more with 'phd launch <N> taskmaster'.")),
       $this->newOption('phd.verbose', 'bool', false)
         ->setBoolOptions(
           array(
             pht("Verbose mode"),
             pht("Normal mode"),
           ))
         ->setSummary(pht("Launch daemons in 'verbose' mode by default."))
         ->setDescription(
           pht(
             "Launch daemons in 'verbose' mode by default. This creates a lot ".
             "of output, but can help debug issues. Daemons launched in debug ".
             "mode with 'phd debug' are always launched in verbose mode. See ".
             "also 'phd.trace'.")),
       $this->newOption('phd.user', 'string', null)
+        ->setLocked(true)
         ->setSummary(pht("System user to run daemons as."))
         ->setDescription(
           pht(
             "Specify a system user to run the daemons as. Primarily, this ".
             "user will own the working copies of any repositories that ".
             "Phabricator imports or manages. This option is new and ".
             "experimental.")),
       $this->newOption('phd.trace', 'bool', false)
         ->setBoolOptions(
           array(
             pht("Trace mode"),
             pht("Normal mode"),
           ))
         ->setSummary(pht("Launch daemons in 'trace' mode by default."))
         ->setDescription(
           pht(
             "Launch daemons in 'trace' mode by default. This creates an ".
             "ENORMOUS amount of output, but can help debug issues. Daemons ".
             "launched in debug mode with 'phd debug' are always launched in ".
             "trace mdoe. See also 'phd.verbose'.")),
     );
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorPHPMailerConfigOptions.php b/src/applications/config/option/PhabricatorPHPMailerConfigOptions.php
index d6ecd39844..c49ae1c2fd 100644
--- a/src/applications/config/option/PhabricatorPHPMailerConfigOptions.php
+++ b/src/applications/config/option/PhabricatorPHPMailerConfigOptions.php
@@ -1,45 +1,50 @@
 <?php
 
 final class PhabricatorPHPMailerConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("PHPMailer");
   }
 
   public function getDescription() {
     return pht("Configure PHPMailer.");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('phpmailer.mailer', 'string', 'smtp')
+        ->setLocked(true)
         ->setSummary(pht("Configure mailer used by PHPMailer."))
         ->setDescription(
           pht(
             "If you're using PHPMailer to send email, provide the mailer and ".
             "options here. PHPMailer is much more enormous than ".
             "PHPMailerLite, and provides more mailers and greater enormity. ".
             "You need it when you want to use SMTP instead of sendmail as the ".
             "mailer.")),
       $this->newOption('phpmailer.smtp-host', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('Host for SMTP.')),
       $this->newOption('phpmailer.smtp-port', 'int', 25)
+        ->setLocked(true)
         ->setDescription(pht('Port for SMTP.')),
       // TODO: Implement "enum"? Valid values are empty, 'tls', or 'ssl'.
       $this->newOption('phpmailer.smtp-protocol', 'string', null)
+        ->setLocked(true)
         ->setSummary(pht('Configure TLS or SSL for SMTP.'))
         ->setDescription(
           pht(
             "Using PHPMailer with SMTP, you can set this to one of 'tls' or ".
             "'ssl' to use TLS or SSL, respectively. Leave it blank for ".
             "vanilla SMTP. If you're sending via Gmail, set it to 'ssl'.")),
       $this->newOption('phpmailer.smtp-user', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('Username for SMTP.')),
       $this->newOption('phpmailer.smtp-password', 'string', null)
         ->setMasked(true)
         ->setDescription(pht('Password for SMTP.')),
     );
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorSecurityConfigOptions.php b/src/applications/config/option/PhabricatorSecurityConfigOptions.php
index 5c5235074e..57a1921003 100644
--- a/src/applications/config/option/PhabricatorSecurityConfigOptions.php
+++ b/src/applications/config/option/PhabricatorSecurityConfigOptions.php
@@ -1,251 +1,256 @@
 <?php
 
 final class PhabricatorSecurityConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Security");
   }
 
   public function getDescription() {
     return pht("Security options.");
   }
 
   public function getOptions() {
     $support_href = PhabricatorEnv::getDoclink('Give Feedback! Get Support!');
 
     return array(
       $this->newOption('security.alternate-file-domain', 'string', null)
+        ->setLocked(true)
         ->setSummary(pht("Alternate domain to serve files from."))
         ->setDescription(
           pht(
             "IMPORTANT: By default, Phabricator serves files from the same ".
             "domain the application lives on. This is convenient but not ".
             "secure: it creates a large class of vulnerabilities which can ".
             "not be generally mitigated.\n\n".
 
             "To avoid this, you should configure a second domain in the same ".
             "way you have the primary domain configured (i.e., point it at ".
             "the same machine and set up the same vhost rules) and provide ".
             "it here. For instance, if your primary install is on ".
             "'http://www.phabricator-example.com/', you could configure ".
             "'http://www.phabricator-files.com/' and specify the entire ".
             "domain (with protocol) here. This will enforce that files are ".
             "served only from the alternate domain. Ideally, you should use ".
             "a completely separate domain name rather than just a different ".
             "subdomain.\n\n".
 
             "It is **STRONGLY RECOMMENDED** that you configure this. Your ".
             "install is **NOT SECURE** unless you do so."))
         ->addExample('http://www.phabricator-files.com/', pht('Valid Setting')),
       $this->newOption(
         'security.hmac-key',
         'string',
         '[D\t~Y7eNmnQGJ;rnH6aF;m2!vJ8@v8C=Cs:aQS\.Qw')
         ->setMasked(true)
+        ->setLocked(true)
         ->setSummary(
           pht("Key for HMAC digests."))
         ->setDescription(
           pht(
             "Default key for HMAC digests where the key is not important ".
             "(i.e., the hash itself is secret). You can change this if you ".
             "want (to any other string), but doing so will break existing ".
             "sessions and CSRF tokens.")),
       $this->newOption('security.require-https', 'bool', false)
         ->setLocked(true)
         ->setSummary(
           pht("Force users to connect via HTTPS instead of HTTP."))
         ->setDescription(
           pht(
             "If the web server responds to both HTTP and HTTPS requests but ".
             "you want users to connect with only HTTPS, you can set this ".
             "to true to make Phabricator redirect HTTP requests to HTTPS.\n\n".
 
             "Normally, you should just configure your server not to accept ".
             "HTTP traffic, but this setting may be useful if you originally ".
             "used HTTP and have now switched to HTTPS but don't want to ".
             "break old links, or if your webserver sits behind a load ".
             "balancer which terminates HTTPS connections and you can not ".
             "reasonably configure more granular behavior there.\n\n".
 
             "IMPORTANT: Phabricator determines if a request is HTTPS or not ".
             "by examining the PHP \$_SERVER['HTTPS'] variable. If you run ".
             "Apache/mod_php this will probably be set correctly for you ".
             "automatically, but if you run Phabricator as CGI/FCGI (e.g., ".
             "through nginx or lighttpd), you need to configure your web ".
             "server so that it passes the value correctly based on the ".
             "connection type."))
         ->setBoolOptions(
           array(
             pht('Force HTTPS'),
             pht('Allow HTTP'),
           )),
       $this->newOption(
         'phabricator.csrf-key',
         'string',
         '0b7ec0592e0a2829d8b71df2fa269b2c6172eca3')
         ->setMasked(true)
+        ->setLocked(true)
         ->setSummary(
           pht("Hashed with other inputs to generate CSRF tokens."))
         ->setDescription(
           pht(
             "This is hashed with other inputs to generate CSRF tokens. If ".
             "you want, you can change it to some other string which is ".
             "unique to your install. This will make your install more secure ".
             "in a vague, mostly theoretical way. But it will take you like 3 ".
             "seconds of mashing on your keyboard to set it up so you might ".
             "as well.")),
        $this->newOption(
          'phabricator.mail-key',
          'string',
          '5ce3e7e8787f6e40dfae861da315a5cdf1018f12')
         ->setMasked(true)
+        ->setLocked(true)
         ->setSummary(
           pht("Hashed with other inputs to generate mail tokens."))
         ->setDescription(
           pht(
             "This is hashed with other inputs to generate mail tokens. If ".
             "you want, you can change it to some other string which is ".
             "unique to your install. In particular, you will want to do ".
             "this if you accidentally send a bunch of mail somewhere you ".
             "shouldn't have, to invalidate all old reply-to addresses.")),
        $this->newOption(
         'uri.allowed-protocols',
         'set',
         array(
           'http' => true,
           'https' => true,
         ))
         ->setSummary(
           pht("Determines which URI protocols are auto-linked."))
         ->setDescription(
           pht(
             "When users write comments which have URIs, they'll be ".
             "automatically linked if the protocol appears in this set. This ".
             "whitelist is primarily to prevent security issues like ".
             "javascript:// URIs."))
         ->addExample("http\nhttps", pht('Valid Setting'))
         ->setLocked(true),
       $this->newOption(
         'uri.allowed-editor-protocols',
         'set',
         array(
           'http' => true,
           'https' => true,
 
           // This handler is installed by Textmate.
           'txmt' => true,
 
           // This handler is for MacVim.
           'mvim' => true,
 
           // Unofficial handler for Vim.
           'vim' => true,
 
           // Unofficial handler for Sublime.
           'subl' => true,
 
           // Unofficial handler for Emacs.
           'emacs' => true,
 
           // This isn't a standard handler installed by an application, but
           // is a reasonable name for a user-installed handler.
           'editor' => true,
         ))
         ->setSummary(pht('Whitelists editor protocols for "Open in Editor".'))
         ->setDescription(
           pht(
             "Users can configure a URI pattern to open files in a text ".
             "editor. The URI must use a protocol on this whitelist.\n\n".
             "(If you use an editor which defines a protocol not on this ".
             "list, [[ %s | let us know ]] and we'll update the defaults.)",
             $support_href))
         ->setLocked(true),
        $this->newOption(
          'celerity.resource-hash',
          'string',
          'd9455ea150622ee044f7931dabfa52aa')
         ->setSummary(
           pht("An input to the hash function when building resource hashes."))
         ->setDescription(
           pht(
             "This value is an input to the hash function when building ".
             "resource hashes. It has no security value, but if you ".
             "accidentally poison user caches (by pushing a bad patch or ".
             "having something go wrong with a CDN, e.g.) you can change this ".
             "to something else and rebuild the Celerity map to break user ".
             "caches. Unless you are doing Celerity development, it is ".
             "exceptionally unlikely that you need to modify this.")),
        $this->newOption('remarkup.enable-embedded-youtube', 'bool', false)
         ->setBoolOptions(
           array(
             pht("Embed YouTube videos"),
             pht("Don't embed YouTube videos"),
           ))
         ->setSummary(
           pht("Determines whether or not YouTube videos get embedded."))
         ->setDescription(
           pht(
             "If you enable this, linked YouTube videos will be embeded ".
             "inline. This has mild security implications (you'll leak ".
             "referrers to YouTube) and is pretty silly (but sort of ".
             "awesome).")),
         $this->newOption('security.allow-outbound-http', 'bool', true)
-        ->setBoolOptions(
-          array(
-            pht("Allow"),
-            pht("Disallow"),
-          ))
-        ->setSummary(
-          pht("Allow outbound HTTP requests"))
-        ->setDescription(
-          pht(
-            "If you enable this, you are allowing Phabricator to potentially ".
-            "make requests to external servers.")),
+          ->setBoolOptions(
+            array(
+              pht("Allow"),
+              pht("Disallow"),
+            ))
+          ->setLocked(true)
+          ->setSummary(
+            pht("Allow outbound HTTP requests"))
+          ->setDescription(
+            pht(
+              "If you enable this, you are allowing Phabricator to ".
+              "potentially make requests to external servers.")),
     );
   }
 
   protected function didValidateOption(
     PhabricatorConfigOption $option,
     $value) {
 
     $key = $option->getKey();
     if ($key == 'security.alternate-file-domain') {
 
       $uri = new PhutilURI($value);
       $protocol = $uri->getProtocol();
       if ($protocol !== 'http' && $protocol !== 'https') {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must start with ".
             "'http://' or 'https://'.",
             $key));
       }
 
       $domain = $uri->getDomain();
       if (strpos($domain, '.') === false) {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must contain a dot ('.'), ".
             "like 'http://example.com/', not just a bare name like ".
             "'http://example/'. Some web browsers will not set cookies on ".
             "domains with no TLD.",
             $key));
       }
 
       $path = $uri->getPath();
       if ($path !== '' && $path !== '/') {
         throw new PhabricatorConfigValidationException(
           pht(
             "Config option '%s' is invalid. The URI must NOT have a path, ".
             "e.g. 'http://phabricator.example.com/' is OK, but ".
             "'http://example.com/phabricator/' is not. Phabricator must be ".
             "installed on an entire domain; it can not be installed on a ".
             "path.",
             $key));
       }
     }
   }
 
 
 }
diff --git a/src/applications/config/option/PhabricatorSendGridConfigOptions.php b/src/applications/config/option/PhabricatorSendGridConfigOptions.php
index 33bf53bb23..898268b598 100644
--- a/src/applications/config/option/PhabricatorSendGridConfigOptions.php
+++ b/src/applications/config/option/PhabricatorSendGridConfigOptions.php
@@ -1,24 +1,25 @@
 <?php
 
 final class PhabricatorSendGridConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Integration with SendGrid");
   }
 
   public function getDescription() {
     return pht("Configure SendGrid integration.");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('sendgrid.api-user', 'string', null)
+        ->setLocked(true)
         ->setDescription(pht('SendGrid API username.')),
       $this->newOption('sendgrid.api-key', 'string', null)
         ->setMasked(true)
         ->setDescription(pht('SendGrid API key.')),
     );
   }
 
 }
diff --git a/src/applications/files/config/PhabricatorFilesConfigOptions.php b/src/applications/files/config/PhabricatorFilesConfigOptions.php
index 5eae1e8277..c942b9254a 100644
--- a/src/applications/files/config/PhabricatorFilesConfigOptions.php
+++ b/src/applications/files/config/PhabricatorFilesConfigOptions.php
@@ -1,199 +1,200 @@
 <?php
 
 /**
  * @group file
  */
 final class PhabricatorFilesConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Files");
   }
 
   public function getDescription() {
     return pht("Configure files and file storage.");
   }
 
   public function getOptions() {
 
     $viewable_default = array(
       'image/jpeg'  => 'image/jpeg',
       'image/jpg'   => 'image/jpg',
       'image/png'   => 'image/png',
       'image/gif'   => 'image/gif',
       'text/plain'  => 'text/plain; charset=utf-8',
       'text/x-diff' => 'text/plain; charset=utf-8',
 
       // ".ico" favicon files, which have mime type diversity. See:
       // http://en.wikipedia.org/wiki/ICO_(file_format)#MIME_type
       'image/x-ico'               => 'image/x-icon',
       'image/x-icon'              => 'image/x-icon',
       'image/vnd.microsoft.icon'  => 'image/x-icon',
 
       'audio/x-wav'     => 'audio/x-wav',
       'application/ogg' => 'application/ogg',
       'audio/mpeg'      => 'audio/mpeg',
     );
 
     $image_default = array(
       'image/jpeg'                => true,
       'image/jpg'                 => true,
       'image/png'                 => true,
       'image/gif'                 => true,
       'image/x-ico'               => true,
       'image/x-icon'              => true,
       'image/vnd.microsoft.icon'  => true,
     );
 
     $audio_default = array(
       'audio/x-wav'     => true,
       'application/ogg' => true,
       'audio/mpeg'      => true,
     );
 
     // largely lifted from http://en.wikipedia.org/wiki/Internet_media_type
     $icon_default = array(
       // audio file icon
       'audio/basic' => 'docs_audio',
       'audio/L24' => 'docs_audio',
       'audio/mp4' => 'docs_audio',
       'audio/mpeg' => 'docs_audio',
       'audio/ogg' => 'docs_audio',
       'audio/vorbis' => 'docs_audio',
       'audio/vnd.rn-realaudio' => 'docs_audio',
       'audio/vnd.wave' => 'docs_audio',
       'audio/webm' => 'docs_audio',
       // movie file icon
       'video/mpeg' => 'docs_movie',
       'video/mp4' => 'docs_movie',
       'video/ogg' => 'docs_movie',
       'video/quicktime' => 'docs_movie',
       'video/webm' => 'docs_movie',
       'video/x-matroska' => 'docs_movie',
       'video/x-ms-wmv' => 'docs_movie',
       'video/x-flv' => 'docs_movie',
       // pdf file icon
       'application/pdf' => 'docs_pdf',
       // zip file icon
       'application/zip' => 'docs_zip',
       // msword icon
       'application/msword' => 'docs_doc',
     ) + array_fill_keys(array_keys($image_default), 'docs_image');
 
     return array(
       $this->newOption('files.viewable-mime-types', 'wild', $viewable_default)
         ->setSummary(
           pht('Configure which MIME types are viewable in the browser.'))
         ->setDescription(
           pht(
             'Configure which uploaded file types may be viewed directly '.
             'in the browser. Other file types will be downloaded instead '.
             'of displayed. This is mainly a usability consideration, since '.
             'browsers tend to freak out when viewing enormous binary files.'.
             "\n\n".
             'The keys in this map are vieweable MIME types; the values are '.
             'the MIME types they are delivered as when they are viewed in '.
             'the browser.')),
       $this->newOption('files.image-mime-types', 'set', $image_default)
         ->setSummary(pht('Configure which MIME types are images.'))
         ->setDescription(
           pht(
             'List of MIME types which can be used as the `src` for an '.
             '`<img />` tag.')),
       $this->newOption('files.audio-mime-types', 'set', $audio_default)
         ->setSummary(pht('Configure which MIME types are audio.'))
         ->setDescription(
           pht(
             'List of MIME types which can be used to render an '.
             '`<audio />` tag.')),
       $this->newOption('files.icon-mime-types', 'wild', $icon_default)
         ->setSummary(pht('Configure which MIME types map to which icons.'))
         ->setDescription(
           pht(
             'Map of MIME type to icon name. MIME types which can not be '.
             'found default to icon `doc_files`.')),
       $this->newOption('storage.mysql-engine.max-size', 'int', 1000000)
         ->setSummary(
           pht(
             'Configure the largest file which will be put into the MySQL '.
             'storage engine.')),
       $this->newOption('storage.local-disk.path', 'string', null)
+        ->setLocked(true)
         ->setSummary(pht('Local storage disk path.'))
         ->setDescription(
           pht(
             "Phabricator provides a local disk storage engine, which just ".
             "writes files to some directory on local disk. The webserver ".
             "must have read/write permissions on this directory. This is ".
             "straightforward and suitable for most installs, but will not ".
             "scale past one web frontend unless the path is actually an NFS ".
             "mount, since you'll end up with some of the files written to ".
             "each web frontend and no way for them to share. To use the ".
             "local disk storage engine, specify the path to a directory ".
             "here. To disable it, specify null.")),
      $this->newOption('storage.s3.bucket', 'string', null)
         ->setSummary(pht('Amazon S3 bucket.'))
         ->setDescription(
           pht(
             "Set this to a valid Amazon S3 bucket to store files there. You ".
             "must also configure S3 access keys in the 'Amazon Web Services' ".
             "group.")),
      $this->newOption(
        'storage.engine-selector',
        'class',
        'PhabricatorDefaultFileStorageEngineSelector')
         ->setBaseClass('PhabricatorFileStorageEngineSelector')
         ->setSummary(pht('Storage engine selector.'))
         ->setDescription(
           pht(
             "Phabricator uses a storage engine selector to choose which ".
             "storage engine to use when writing file data. If you add new ".
             "storage engines or want to provide very custom rules (e.g., ".
             "write images to one storage engine and other files to a ".
             "different one), you can provide an alternate implementation ".
             "here. The default engine will use choose MySQL, Local Disk, and ".
             "S3, in that order, if they have valid configurations above and ".
             "a file fits within configured limits.")),
      $this->newOption('storage.upload-size-limit', 'string', null)
         ->setSummary(
           pht('Limit to users in interfaces which allow uploading.'))
         ->setDescription(
           pht(
             "Set the size of the largest file a user may upload. This is ".
             "used to render text like 'Maximum file size: 10MB' on ".
             "interfaces where users can upload files, and files larger than ".
             "this size will be rejected. \n\n".
             "NOTE: **Setting this to a large size is NOT sufficient to ".
             "allow users to upload large files. You must also configure a ".
             "number of other settings.** To configure file upload limits, ".
             "consult the article 'Configuring File Upload Limits' in the ".
             "documentation. Once you've configured some limit across all ".
             "levels of the server, you can set this limit to an appropriate ".
             "value and the UI will then reflect the actual configured ".
             "limit.\n\n".
             "Specify this limit in bytes, or using a 'K', 'M', or 'G' ".
             "suffix."))
         ->addExample('10M', pht("Allow Uploads 10MB or Smaller")),
      $this->newOption(
         'metamta.files.public-create-email',
         'string',
         null)
         ->setDescription(pht('Allow uploaded files via email.')),
      $this->newOption(
         'metamta.files.subject-prefix',
         'string',
         '[File]')
         ->setDescription(pht('Subject prefix for paste email.')),
      $this->newOption('files.enable-imagemagick', 'bool', false)
        ->setBoolOptions(
          array(
            pht('Enable'),
            pht('Disable')
          ))->setDescription(
              pht("This option will enable animated gif images".
-                  "to be set as profile pictures. The \'convert\' binary ".
+                  "to be set as profile pictures. The 'convert' binary ".
                   "should be available to the webserver for this to work")),
 
     );
   }
 
 }
diff --git a/src/applications/phame/config/PhabricatorPhameConfigOptions.php b/src/applications/phame/config/PhabricatorPhameConfigOptions.php
index 4931623d94..1ec6f2aeae 100644
--- a/src/applications/phame/config/PhabricatorPhameConfigOptions.php
+++ b/src/applications/phame/config/PhabricatorPhameConfigOptions.php
@@ -1,27 +1,28 @@
 <?php
 
 final class PhabricatorPhameConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Phame");
   }
 
   public function getDescription() {
     return pht("Configure Phame blogs.");
   }
 
   public function getOptions() {
     return array(
       $this->newOption(
         'phame.skins',
         'list<string>',
         array(
           'externals/skins/',
         ))
+        ->setLocked(true)
         ->setDescription(
           pht('List of directories where Phame will look for skins.')),
     );
   }
 
 }
diff --git a/src/applications/phortune/option/PhabricatorPhortuneConfigOptions.php b/src/applications/phortune/option/PhabricatorPhortuneConfigOptions.php
index fcea8e3746..02bc1d468b 100644
--- a/src/applications/phortune/option/PhabricatorPhortuneConfigOptions.php
+++ b/src/applications/phortune/option/PhabricatorPhortuneConfigOptions.php
@@ -1,69 +1,70 @@
 <?php
 
 final class PhabricatorPhortuneConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Phortune");
   }
 
   public function getDescription() {
     return pht("Configure payments and billing.");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('phortune.stripe.publishable-key', 'string', null)
         ->setLocked(true)
         ->setDescription(pht('Stripe publishable key.')),
       $this->newOption('phortune.stripe.secret-key', 'string', null)
         ->setHidden(true)
         ->setDescription(pht('Stripe secret key.')),
       $this->newOption('phortune.balanced.marketplace-uri', 'string', null)
         ->setLocked(true)
         ->setDescription(pht('Balanced Marketplace URI.')),
       $this->newOption('phortune.balanced.secret-key', 'string', null)
         ->setHidden(true)
         ->setDescription(pht('Balanced secret key.')),
       $this->newOption('phortune.test.enabled', 'bool', false)
         ->setBoolOptions(
           array(
             pht('Enable Test Provider'),
             pht('Disable Test Provider'),
           ))
         ->setSummary(pht('Enable test payment provider.'))
         ->setDescription(
           pht(
             "Enable the test payment provider.\n\n".
             "NOTE: Enabling this provider gives all users infinite free ".
             "money! You should enable it **ONLY** for testing and ".
             "development."))
         ->setLocked(true),
       $this->newOption('phortune.paypal.api-username', 'string', null)
         ->setLocked(true)
         ->setDescription(
           pht('PayPal API username.')),
       $this->newOption('phortune.paypal.api-password', 'string', null)
         ->setHidden(true)
         ->setDescription(
           pht('PayPal API password.')),
       $this->newOption('phortune.paypal.api-signature', 'string', null)
         ->setHidden(true)
         ->setDescription(
           pht('PayPal API signature.')),
       $this->newOption('phortune.wepay.client-id', 'string', null)
         ->setLocked(true)
         ->setDescription(pht('WePay application ID.')),
       $this->newOption('phortune.wepay.client-secret', 'string', null)
         ->setHidden(true)
         ->setDescription(pht('WePay application secret.')),
       $this->newOption('phortune.wepay.access-token', 'string', null)
         ->setHidden(true)
         ->setDescription(pht('WePay access token.')),
       $this->newOption('phortune.wepay.account-id', 'string', null)
+        ->setLocked(true)
         ->setHidden(true)
         ->setDescription(pht('WePay account ID.')),
     );
   }
 
 }
diff --git a/src/applications/repository/PhabricatorRepositoryConfigOptions.php b/src/applications/repository/PhabricatorRepositoryConfigOptions.php
index a641647be2..cae49f60db 100644
--- a/src/applications/repository/PhabricatorRepositoryConfigOptions.php
+++ b/src/applications/repository/PhabricatorRepositoryConfigOptions.php
@@ -1,31 +1,32 @@
 <?php
 
 /**
  * @group repository
  */
 final class PhabricatorRepositoryConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht('Repositories');
   }
 
   public function getDescription() {
     return pht('Configure repositories.');
   }
 
   public function getOptions() {
     return array(
       $this->newOption('repository.default-local-path', 'string', '/var/repo/')
+        ->setLocked(true)
         ->setSummary(
           pht("Default location to store local copies of repositories."))
         ->setDescription(
           pht(
             "The default location in which to store working copies and other ".
             "data about repositories. Phabricator will control and manage ".
             "data here, so you should **not** choose an existing directory ".
             "full of data you care about.")),
     );
   }
 
 }