Allow access to all actions by default

I think it's easier to specify the restricted actions rather than the
unrestricted ones.