Best way to deny access to URL

Assuming all the links in those applications are prefaced with those uris:

when HTTP_REQUEST {
  if { !(([string tolower [HTTP::uri]] starts_with '/nyc') || ([string tolower [HTTP::uri]] starts_with '/albany')) } {
    HTTP::respond 403
  }
}