Auth fixes

Allow the environment variable ACCESS_LIST to be either an array or a string.