don't fire isAllowed check for console requests