changed default to allow, could be that we don't have any RequestPermissionResolver.
query uses userId