#69 Don't set accessAllowed to false, it confuses shiro