code: def get_url(request, application, roles, label=None):
      
      args = []
      if label is not None:
          args.append(label)
  
      # don't use secret_token unless we have to
      if 'is_admin' in roles:
          # Administrators can access anything without secrets
          require_secret = False
      elif 'is_applicant' not in roles:
          # we never give secrets to anybody but the applicant
          require_secret = False
      elif not request.user.is_authenticated:
          # If applicant is not logged in, we redirect them to secret URL
          require_secret = True
      elif request.user != application.applicant:
          # If logged in as different person, we redirect them to secret
          # URL. This could happen if the application was open with a different
          # email address, and the applicant is logged in when accessing it.
          require_secret = True
      else:
          # otherwise redirect them to URL that requires correct login.
          require_secret = False
  
      # return required url
      if not require_secret:
          url = reverse(
              'kg_application_detail',
              args=[application.pk, application.state] + args)
      else:
          url = reverse(
              'kg_application_unauthenticated',
              args=[application.secret_token, application.state] + args)
      return url
docs: Retrieve a link that will work for the current user.