URL-based security in thymeleaf templates
AJAX + proxy indications from TrialVerse