added access control to urls