No allow/deny once for functions that require a restart

Fixes #1622