Add allow_only for auth.