using URLs instead of route names for firewall