Default new access lists to allow-by-default

Basic-Auth-only access lists (no CIDR rules) were unreachable: with
Default allow off, checkAccess denied every IP with 403 before the
auth prompt ever ran. New lists now default to allow-by-default, and
the label clarifies the interaction with Basic Auth.

internal/web/accesslists.go

@@ -25,7 +25,7 @@ func (h *Web) handleAccessListsList(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Web) handleAccessListForm(w http.ResponseWriter, r *http.Request) {
-	var l models.AccessList
+	l := models.AccessList{DefaultAllow: true}
 	isNew := true
 	if idStr := r.PathValue("id"); idStr != "" {
 		isNew = false

internal/web/templates/access_list_form.html

@@ -11,7 +11,7 @@
     <div class="col-md-3 d-flex align-items-end">
       <div class="form-check form-switch">
         <input class="form-check-input" type="checkbox" name="default_allow" id="da" {{if $l.DefaultAllow}}checked{{end}}>
-        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed)</label>
+        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed) &mdash; leave this checked if you only want Basic Auth below and no IP restriction</label>
       </div>
     </div>
     <div class="col-12">