UrWeb: more 'allow' combinators