bugfix: web/.htaccess: forced mod_autoindex listing: use $usernames_disabled to ensure that usernames stay disabled even when /all path is removed