use $user->isAllowed() for check auth