Improve error messages in auth

**Feature request**
It would be great to have filtering for services.

**Use case**
Many users need this functionality for production deployments.

**Implementation idea**
Add a new config option `enable_filtering` with default `false`.

The issue names no files, entry points, or tests. Start by locating the service configuration and authentication handling in this Shell repository, then clarify how service filtering should work and where the enable_filtering option belongs. Done means the behavior is specified, disabled by default, and covered by focused tests.

Written by the indexing model from the issue text.