Restricting /assets to non logged in users

Hi, why don't you use the simplest restriction, check if there's a session opened, if not, redirect the "intruder" to the public page. This is usually set on the header template.