Assuming someone using Varify does not change which URLs are protected, this check is redundant since the resource is already protected by the django-siteauth middleware.