don't forget about the assert_protected_action function, a little nicer IMHO :)   not required though