Pass in request/response to protect() function also.