If people type in the url, can't they access anything?