Deny all by default unless allowed in conf include