handlers are invoked only when user is not allowed