Add tunnelAllowedPort option, check before serving CONNECT request.
Comment: why can't require authentication for PAC.