Did I get the idea wrong?
IMHO you are trying to block an URL if there has no
user logged in correctly, right?

Your code handles the lonely user trying to get that,
but as soon as he is lucky, any other user can reach
the URL, because the index.html exists.

Another anoying thing is, that one might type your
URL completed with indexalt.html to reach it
directly.

I don't think, that this is an useable idea to
protect one's URL from unauthorized visits.

--
there are no silly questions
killerhippy