Protect URLs, add session support