need to check for null first, only then dereference allowedArray to avoid NPE