The Allow list was only checked in CZNC::AuthUser() after the core password check, so logins accepted by imapauth, cyrusauth or certauth (including SASL EXTERNAL) ignored it. Check it in CAuthBase::AcceptLogin() and CClient::AcceptSASLLogin() instead.