Now that we use Match() in allowAdmin() as well, it's awkward to
have it return `true` when called with an empty admin list.
No admins defined was taken to mean "everyone is an admin".
We can either have a `len(users) == 0` check in `allowAdmin` which
rejects the request, or we can change `Match()` so that it doesn't
return positive responses when called with an empty list. Doing the
latter sounds better. It's more natural that matching against an empty list
will yield "no match".
e59f5d5502