updated allowed to allow internal requests through. added check in query and save