There's more than one way to skin a cat. Here's what I did all in /etc/cups/cupsd.conf:
I changed Listen localhost:631 to Port 631
I added Allow all to <Location />, <Location /admin> and <Location /admin/conf>
The only other line in those three spots is Order allow, deny
These settings might seem overly permissive but I believe the <Limit> sections provide sufficient protection.
Anyway now it all works spotlessly. I really shouldn't take credit for this. I found the solution in
https://wiki.archlinux.org/index.php...e_and_tool-kit