@malcolmsparks: i implemented resource protection by modifying resources and other handlers in my bidi routing structure... it turns out moderately complicated, with different handling required for yada resources, non-yada handlers and CORS OPTIONS requests ... here's what i ended up with in case it's any use to you - https://www.refheap.com/109901