Added $allowed_actions that are now required in 3.1

Added $allowed_actions statics for URL access.  Now required in 3.1 otherwise it doesn't let you create or change widgets. See: http://doc.silverstripe.org/framework/en/3.1/changelogs/3.1.0#deny-url-access-if-controller-allowed-actions-is-undefined-or-empty-array