The following also does not work and allows all Options instead of only listed ones:
AllowOverride Options=Indexes,IncludesNOEXEC,MultiViews
The bad thing is that it allows +ExecCGI, and even "DisableCgiOverride On" does not stop user from enabling CGI in .htaccess. BTW, "DisableCgiOverride On" also does not work for directories defined by ScriptAlias.
