Implement must_be_protected URL