Gate both kiosks behind a device token, and make an unreachable setting a test failure

plugins/usb/plugin.py

@@ -138,6 +138,18 @@ class USBPlugin(BasePlugin):
                                'a device between checked-out and checked-in - it '
                                'cannot add, edit, retire or list devices.',
             },
+            {
+                'key': 'usb_kiosk_token',
+                'value': '',
+                # string: the column documents string/boolean/integer/json.
+                # Masking keys on the NAME containing 'token'.
+                'valuetype': 'string',
+                'category': 'usb',
+                'description': 'Device token the USB kiosk sends as '
+                               'X-Kiosk-Token. Generate one, then open the '
+                               'kiosk once as /usb-kiosk?token=<value> on each '
+                               'screen',
+            },
             {
                 'key': 'usb_kiosk_allow_return_for_others',
                 'value': 'true',