require login for URLs not defined with anonymous access