Use require_action_allowed to check moderator access