don't set user's "allowed_fields" unless they have access to more than
just the default list