enable HMAC message signing by default in notebook kernels

This is separate from previous, because it is more likely to be rejected.

It requires the the Session objects in Handlers get a reference all the way back up to the IPython App that started the environment.

IPython/frontend/html/notebook/handlers.py

@@ -173,7 +173,13 b' class ZMQStreamHandler(websocket.WebSocketHandler):'
 class AuthenticatedZMQStreamHandler(ZMQStreamHandler):
     def open(self, kernel_id):
         self.kernel_id = kernel_id.decode('ascii')
-        self.session = Session()
+        try:
+            cfg = self.application.ipython_app.config
+        except AttributeError:
+            # protect from the case where this is run from something other than
+            # the notebook app:
+            cfg = None
+        self.session = Session(config=cfg)
         self.save_on_message = self.on_message
         self.on_message = self.on_first_message
 

IPython/frontend/html/notebook/kernelmanager.py

@@ -70,7 +70,8 b' class MultiKernelManager(LoggingConfigurable):'
         kernel_id = unicode(uuid.uuid4())
         # use base KernelManager for each Kernel
         km = KernelManager(connection_file=os.path.join(
-                    self.connection_dir, "kernel-%s.json" % kernel_id)
+                    self.connection_dir, "kernel-%s.json" % kernel_id),
+                    config=self.config,
         )
         km.start_kernel(**kwargs)
         self._kernels[kernel_id] = km

IPython/frontend/html/notebook/notebookapp.py

@@ -44,7 +44,7 b' from .notebookmanager import NotebookManager'
 
 from IPython.core.application import BaseIPythonApplication
 from IPython.core.profiledir import ProfileDir
-from IPython.zmq.session import Session
+from IPython.zmq.session import Session, default_secure
 from IPython.zmq.zmqshell import ZMQInteractiveShell
 from IPython.zmq.ipkernel import (
     flags as ipkernel_flags,
@@ -128,6 +128,10 b' aliases.update({'
     'notebook-dir': 'NotebookManager.notebook_dir',
 })
 
+# remove ipkernel flags that are singletons, and don't make sense in
+# multi-kernel evironment:
+aliases.pop('f', None)
+
 notebook_aliases = [u'port', u'ip', u'keyfile', u'certfile', u'ws-hostname',
                     u'notebook-dir']
 
@@ -231,6 +235,8 b' class IPythonNotebookApp(BaseIPythonApplication):'
         # Don't let Qt or ZMQ swallow KeyboardInterupts.
         signal.signal(signal.SIGINT, signal.SIG_DFL)
 
+        # force Session default to be secure
+        default_secure(self.config)
         # Create a KernelManager and start a kernel.
         self.kernel_manager = MappingKernelManager(
             config=self.config, log=self.log, kernel_argv=self.kernel_argv,