erp5_web_renderjs_ui&test: allow anonymous access if has allowed list

in "Disable XhtmlStyle" 's configuration

we still allow some users to use xhtml style interface when it's disabled.

but if user is not logged in, we can't get his user id,

as result, he can't use xhtml style interface and always get xhtml_style is disabled. Please use ERP5JS' message.

To fix this issue, we allow anonymous access if allowed list is not empty, so that user can login and we can check user id