fixed redirects and direct access prevention