Initially using an `"allow"` block. _Split from https://github.com/simonw/datasette-update-api/issues/2#issuecomment-660299582_