...
<shopping_cart_on>true</shopping_cart_on>
Customization of the domain security policy:
By default the domain is open to public. People can use http to access thalia as a guest. However some domains only want to be open to the MIT community.
Use <opentopublic>false</opentopublic> to indicate that only people with MIT certificate can access thalia.