Basic-Auth-only access lists (no CIDR rules) were unreachable: with
Default allow off, checkAccess denied every IP with 403 before the
auth prompt ever ran. New lists now default to allow-by-default, and
the label clarifies the interaction with Basic Auth.