Allow overriding AccessRequirements to a zero-length string.

This allows disabling authentication after a higher level specifies an
AccessRequirements value, eliminating the last reason to keep access.ars
around.