Add allow_if option for more flexible acess control

The logic added here might be better refactored to a new method, but I'm not sure. It's definitely a bit ugly right now, and the right way to fix that is with design changes (like deprecating/removing `herokai_only` entirely).