Lockboxes actually check the used ID
Created by: Sprok0
fixes #12149 (closed)
makes unset req_access and req_one_access an empty list rather than just a null so can_access() will work on things without req_access
Unrelated, but both this and the vanishing when opened in-hand bugs existed before my recent lockbox change