lock url user better