Can't help but I've had problems that might be related, maybe someone else can help us both.
I'm using HTS Tvheadend 4.1.1945 ~ LibreELEC Tvh-addon v7.0.102 on an RPi.
No problems with the default uncontrolled access.
Today I tried setting up specific users & passwords to get things better controlled, and hit some problems.
First I made what was (with hindsight) a schoolboy error, I modified the default user to be called "Admin". Left the other settings alone apart from specifying languages. Immediately I saved this I was prompted for username and password (I hadn't specified a password). Nothing I could think of would get me logged in. Admin and blank password, Admin and Admin, etc etc, it just kept re-prompting. I only resolved this by SSHing into libreelec, finding the TVHeadend access control file (/storage/.kodi/userdata/addon_data/service.tvheadend42/accesscontrol, if anyone else needs to do this) and, in the end, finding that if I changed the user name back to * things were OK again.
After wiping away the sweat (I'm new to this game), I tried again, leaving the default user in place this time just in case. I set up Admin as a new user, and specified a password, and access only from the local network (192.168.1.0/24). I could then log in as Admin to the server on the Pi from my PC on the local network, as expected. However, sometimes, apparently randomly, on changing from one TVH tab to another, I would be prompted to log in again, and nothing was acceptable. If I closed the browser (Chrome) and started again, I got in OK.
I also set up a user called Remote, for DVR-only access, from any network (0.0.0.0/0). I successfully logged in from the local network PC (albeit with the same random blocks as for Admin), but I have not been able to log in at all via an external server, the login prompt comes up fine but login details are not accepted.
Can anyone shed any light?