added URL-level security