Hello. Currently authentication system works as following:

menuentry "name" --users "a,b,c" {
}
Means that only superusers and users "a", "b" and "c" are permitted to
boot this menuentry. To allow only superusers to boot an entry one would
need:
menuentry "name" --users "" {
}
And absence of --users means "anyone can choose this entry".
Unfortunately this is error-prone. Does anyone oppose to change it to:
No --users: only superusers
To have an unlocked entry you have to add --unlocked

-- 
Regards
Vladimir 'φ-coder/phcoder' Serbinenko