This is to prevent rogue CGIs from doing harm to user accounts. Its access protection does not extend to directories below it in the tree. This allows you to protect several files with particular patterns in their name at once. File names with path or directory information will be ignored. Method is one of Put, Get or Post.
Group is a group name.
This is highly dependent on what the Require tag specified. It can be a group name maintained by you or a system login userid. User is a userid. This is highly dependent on what the Require tag specified. It can be a single userid maintained by you or a system login userid.