how to prevent pages from direct access