Default new access lists to allow-by-default

Basic-Auth-only access lists (no CIDR rules) were unreachable: with
Default allow off, checkAccess denied every IP with 403 before the
auth prompt ever ran. New lists now default to allow-by-default, and
the label clarifies the interaction with Basic Auth.

internal/web/accesslists.go

@@ -25,7 +25,7 @@ func (h *Web) handleAccessListsList(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Web) handleAccessListForm(w http.ResponseWriter, r *http.Request) {
-	var l models.AccessList
+	l := models.AccessList{DefaultAllow: true}
 	isNew := true
 	if idStr := r.PathValue("id"); idStr != "" {
 		isNew = false