    def _get_allowed_paths(self, has_device):
        """Return the paths the user may visit when not verified via otp.

        If the user already has a registered device, return a limited set of
        paths to prevent them from adding or listing devices to prevent them
        from adding or listing devices.
        """
        allowed_url_names = self._allowed_url_names
        if not has_device:
            allowed_url_names = self._allowed_url_names_no_device

        results = []
        for route_name in allowed_url_names:
            try:
                results.append(settings.WAGTAIL_MOUNT_PATH + reverse(route_name))
            except NoReverseMatch:
                pass
        return results