server: default sv_newpurelist to 1 and change the flag to CVAR_ROM
server: forgot to exclude some rcon user list functionaloties with USE_AUTH