What happens if you leave out an `access callback` specification?
Yes it uses user_access() by default, but only when you specify 'access arguments'. See http://api.drupal.org/api/drupal/modules--system--system.api.php/function/hook_menu/7.