added access check to url update function