Set allowed_actions to private 

Trying to find a bug where stepped checkout does not display the correct step at the checkout url