when you first make a request to the protected resource, the container will not be knowing whether it is protected or not. Once it comes to know that the requested resource is protected (by looking at the DD), it will send the response asking for the username and password. So if you type the url directly that means you are requesting for that page itself, which will not be served by the container at any cost