Move protect(User) statements to before filter