Must specify ipaddrs, even when using callbacks

I'm just preparing for a new release of this module, and hit an inconsistency between code and docs.  In previous versions you *must* specify the ipaddrs argument, but this became optional when the get_userid/get_principals callbacks were added.  I think it makes more sense to retain the old behaviour, where you must explicitly state the set of ips to be covered by this policy.  The special set "all" can be used to explicitly declare that all requests should be matched.

@mrijken what do you think?  Will this break things for you at all?