Add auth_allowed parameter

I don't think you have to write ```['$1']``` here, but it might be clearer.