remoteuser - Patch for default setting and improved checking in hasAccess()

I noticed a strange default setting of remoteuser.

I also noticed hasAccess() did not check this default setting.

Furthermore I think the following code in hasAccess() should at least return false, even better would be to remove it completely, as this feels like circumventing all security mechanisms:

        if(trim($conf['remoteuser']) == '') {
            return true;
        }