[Zope] prevent direct (only) access from url