def protected(self, *tests, **kwargs):
        _role = kwargs.pop('role', None)
        _roles = kwargs.pop('roles', None) or []
        _csrf = kwargs.pop('csrf', None)
        _url_sign_in = kwargs.pop('url_sign_in', None)
        _request = kwargs.pop('request', None)
        if _role:
            _roles.append(_role)
        _roles = [to_unicode(r) for r in _roles]
        _tests = tests
        _user_tests = kwargs
        def decorator(f):
            @functools.wraps(f)
            def wrapper(*args, **kwargs):
                logger = logging.getLogger(__name__)
                request = _request or self.request or args and args[0]
                url_sign_in = self._get_url_sign_in(request, _url_sign_in)
                user = self.get_user()
                if not user:
                    return self._login_required(request, url_sign_in)
                if hasattr(user, 'has_role') and _roles:
                    if not user.has_role(*_roles):
                        logger.debug(u'User `{0}`: has_role fail'.format(user.login))
                        logger.debug(u'User roles: {0}'.format([r.name for r in user.roles]))
                        return self.wsgi.raise_forbidden()
                for test in _tests:
                    test_pass = test(user, *args, **kwargs)
                    if not test_pass:
                        logger.debug(u'User `{0}`: test fail'.format(user.login))
                        return self.wsgi.raise_forbidden()
                for name, value in _user_tests.items():
                    user_test = getattr(user, name)
                    test_pass = user_test(value, *args, **kwargs)
                    if not test_pass:
                        logger.debug(u'User `{0}`: test fail'.format(user.login))
                        return self.wsgi.raise_forbidden()
                disable_csrf = _csrf == False
                if (not self.wsgi.is_idempotent(request) and not disable_csrf) or _csrf:
                    if not self.csrf_token_is_valid(request):
                        logger.debug(u'User `{0}`: invalid CSFR token'.format(user.login))
                        return self.wsgi.raise_forbidden("CSFR token isn't valid")
                return f(*args, **kwargs)
            return wrapper
        return decorator