Unable to ssh tunnel into ACS DCOS Cluster

[dcos-on-acs](https://github.com/Azure/azure-quickstart-templates/tree/master/101-acs-dcos)
### Issue Details

Creating the ACS DCOS cluster by following the steps written in the tutorial works great. After the cluster gets available I connected my local machine with `ssh` tunnel: `sudo ssh -v -i ~/.ssh/id_rsa -L 80:localhost:80 -f -N azureuser@xxxxxmgmt.northeurope.cloudapp.azure.com -p 2200`

When then either opening `http://localhost/` in the browser or using the Marathon API (`curl localhost/marathon/v2/apps`) I get this error: `channel 2: open failed: administratively prohibited: open failed`.

It seems to be an issue of the `sshd_config` on the DCOS master, which should be covered in the template/guide.
### Repro steps (_if necessary, delete otherwise_)
1. `azure group create -n "acs-test1" -l "North Europe" --template-uri https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/101-acs-mesos/azuredeploy.json`
2. Wait for successful deployment.
3. `sudo ssh -v -i ~/.ssh/id_rsa -L 80:localhost:80 -f -N azureuser@xxxxxmgmt.northeurope.cloudapp.azure.com -p 2200`
4. `curl localhost/marathon/v2/apps`
5. Log shows `channel 2: open failed: administratively prohibited: open failed`
6. I verified with two accounts, two local machines, also the creation of the ACS Cluster via the portal.

Start with the linked 101-acs-dcos template and tutorial, then reproduce the SSH tunnel and curl localhost/marathon/v2/apps steps from the issue. Inspect the DCOS master sshd_config and the template or guide instructions; the work is done when the tunnel opens without the administratively prohibited error and the Marathon API responds.

Written by the indexing model from the issue text.