zauth can now deny and allow