Added a test for isAllowed when page serving from a controller that "needsLogin".