I think this belongs in couch_httpd_auth where the other _users settings live.