allow key in routes is now optional

array() by default => allowed resource