use allowy for billing event permissions
add some defensive 'no_access' tests