The `@permission_required('wiki.move_tree')` will still stop unauthorized users even if they know or guess the url.