Changed EAV setup to Core Resource and added _isAllowed() method to controller thanks to feedback from Ben on Smashing Magazine comments