kiosk: Tighten cert manager UI

chrome/browser/chromeos/login/app_launch_controller.cc

Index: chrome/browser/chromeos/login/app_launch_controller.cc
diff --git a/chrome/browser/chromeos/login/app_launch_controller.cc b/chrome/browser/chromeos/login/app_launch_controller.cc
index 31adbbe81ad0ac477817e19af6a6d69ba25ee3e8..9dc005718e0e04cc4f9c255f43ef9d1df1e1abc3 100644
--- a/chrome/browser/chromeos/login/app_launch_controller.cc
+++ b/chrome/browser/chromeos/login/app_launch_controller.cc
@@ -361,8 +361,9 @@ bool AppLaunchController::CanConfigureNetwork() {
       return should_prompt;
     }
 
-    // Default to true to allow network configuration if the policy is missing.
-    return true;
+    // Network configuration has to be explicitly allowed by the policy.
+    // Default to false if the policy is missing.
+    return false;
   }
 
   return user_manager::UserManager::Get()->GetOwnerAccountId().is_valid();