Use allowed-device? not allowed-user?