return false for allow? when token is not found