Filtering url that not allowed for current user