 defeats the purpose, doesn't it?  I think this should default to 
 failing.  That was what was intended; otherwise it would be named
 disallow() ...
