make sure requests are never porcessed outised allowed window