In two places, actually.
I need it in nav.inc.php in order to only show the link to the new page to the admin user, and then I need it in the new page itself (newpage.php, let's call it) so that it can't be called directly.
In the second instance, I guess I would be happy with anything that stops the page from being displayed outside of the ISPConfig frame. It could even just direct everyone that tries to access it to the ISPConfig login and then if it is the legitimate admin that wants it, he can can log in and then access it via the menu item.
Does that make sense?