allow_access_ is a critical resource shared across requests regardless of source (i.e. network or JavaScript). So just follow what AwCookieAccessPolicy do to lock it.