Fix JSON API to return an object for /config/allow-from

Can't return arrays for stuff that isn't a collection.