`allow` can be called on the client, so the `isServer` check isn't necessary