model: bugfix - mo_may_allow was too restrictive