allow all actions by default