use ENABLE_MASQUERADE in masquerade.py

lms/djangoapps/courseware/masquerade.py

@@ -8,6 +8,7 @@ import json
 import logging
 
 from django.http import HttpResponse
+from django.conf import settings
 
 log = logging.getLogger(__name__)
 
@@ -39,6 +40,9 @@ def setup_masquerade(request, staff_access=False):
     if request.user is None:
         return None
 
+    if not settings.MITX_FEATURES.get('ENABLE_MASQUERADE', False):
+        return None
+
     if not staff_access:  # can masquerade only if user has staff access to course
         return None