According to here:
Note it gave us the new contract address. Where did this address come from? It is the sha3 hash of the RLP encoding of the list [address of sender, sequence number of sender].
If you know in advance at what tx nonce you will deploy Allower and you can make this RLP calculation yourself, then you can calculate the address to pass to the constructor of your Allowed contract. And vice-versa.
Let's reproduce this Python script in Javascript:
#!/usr/bin/nodejs
var ethJsUtil = require('ethereumjs-util');
var account = "0x6ac7ea33f8831ea9dcc53393aaa88b25a785dbf0";
console.log("nonce0= " + ethJsUtil.bufferToHex(ethJsUtil.generateAddress(account, 0)));
console.log("nonce1= " + ethJsUtil.bufferToHex(ethJsUtil.generateAddress(account, 1)));
console.log("nonce2= " + ethJsUtil.bufferToHex(ethJsUtil.generateAddress(account, 2)));
console.log("nonce3= " + ethJsUtil.bufferToHex(ethJsUtil.generateAddress(account, 3)));