code: def protected(self, *tests, **kwargs):
          _role = kwargs.pop('role', None)
          _roles = kwargs.pop('roles', None) or []
          _csrf = kwargs.pop('csrf', None)
          _url_sign_in = kwargs.pop('url_sign_in', None)
          _request = kwargs.pop('request', None)
          if _role:
              _roles.append(_role)
          _roles = [to_unicode(r) for r in _roles]
          _tests = tests
          _user_tests = kwargs
          def decorator(f):
              @functools.wraps(f)
              def wrapper(*args, **kwargs):
                  logger = logging.getLogger(__name__)
                  request = _request or self.request or args and args[0]
                  url_sign_in = self._get_url_sign_in(request, _url_sign_in)
                  user = self.get_user()
                  if not user:
                      return self._login_required(request, url_sign_in)
                  if hasattr(user, 'has_role') and _roles:
                      if not user.has_role(*_roles):
                          logger.debug(u'User `{0}`: has_role fail'.format(user.login))
                          logger.debug(u'User roles: {0}'.format([r.name for r in user.roles]))
                          return self.wsgi.raise_forbidden()
                  for test in _tests:
                      test_pass = test(user, *args, **kwargs)
                      if not test_pass:
                          logger.debug(u'User `{0}`: test fail'.format(user.login))
                          return self.wsgi.raise_forbidden()
                  for name, value in _user_tests.items():
                      user_test = getattr(user, name)
                      test_pass = user_test(value, *args, **kwargs)
                      if not test_pass:
                          logger.debug(u'User `{0}`: test fail'.format(user.login))
                          return self.wsgi.raise_forbidden()
                  disable_csrf = _csrf == False
                  if (not self.wsgi.is_idempotent(request) and not disable_csrf) or _csrf:
                      if not self.csrf_token_is_valid(request):
                          logger.debug(u'User `{0}`: invalid CSFR token'.format(user.login))
                          return self.wsgi.raise_forbidden("CSFR token isn't valid")
                  return f(*args, **kwargs)
              return wrapper
          return decorator