Lack of documentation for the deny_by_default flag