enforce a 'deny all' default rule

this ensures that an access list is 'secure by default' and requires the user to create exceptions or holes in the proection instead of building the wall entirely. This also means that we no longer require the user to input any username/passwords or client addressses and can avoid internal errors which generate unhelpful user errors.

frontend/js/app/nginx/access/form.js

@@ -119,7 +119,7 @@ module.exports = Mn.View.extend({
             }
         }
 
-        let clients_to_add = 5 - clients.length;
+        let clients_to_add = 4 - clients.length;
         if (clients_to_add) {
             for (let i = 0; i < clients_to_add; i++) {
                 clients.push({});