Add auth_allowed parameter

This explicit casting to array is no longer needed since we have validate_array.