removed allow_actions in patient.php