protectVisbility now async, serves up default files if user not authed