API change (backward compatible?): AuthAllow, AuthDeny: use domain; adddress can also be CIDR address + mask