This should be a protected URL, right? Otherwise, a person wouldn't need to use the code given to them, they could try any code.  

If that made any sense, and you agree, all you have to do is add `protected!` at the beginning of the block...