Don't allow basic authentication (web, API) if users list is empty

[Ahmed Mohamedeen]

I was locked out today when I was going through the new settings in the web interface by toggling "Require Authentication (web, API)" on while I had no users in the settings/env, couldn't do anything, probably this settings needs to be a little more fool-proof to avoid situations like this.

version: 3.3.6

[Rob Wood]

This has been done as part of PR #1428. Note that it's only valided in the settings UI and also only applies to the "web" auth setting.