refactor navigation to use allow rather than current session helpers