I found the directions for mod_userdir to be a little confusing.
If you want
all of your users to be able to access their sites via
https://servername/~username, what you need to do is enable mod_userdir, then check the Exclude Protection box for DefaultHost (nobody).
If you want only a few of your users to be able to access their sites via
https://servername/~username, say during development before their DNS are set, just include their usernames in the "additional users" box on the same line as DefaultHost (nobody). The Exclude Protection box doesn't need to be checked.
My understanding is that if you check an Exclude Protection by a specific host; e.g., thedomain.com, that means that
any username could be appended to that domain (
http://thedomain.com/~username) and access their site, stealing bandwidth from the domain.