security rules for pages that are accessed directly (not through a controller)