When no destination is given to the protected-node page callback, the page is rendered twice

When no destination is given to the protected-node page callback, the page is rendered twice. The whole page layout shows up twice beneath each other with in each an Access Denied message.

function protected_node_enterpassword( ) {

  if (!isset( $_GET['destination'] )) {
    // Illegal call
    watchdog( 'protected_node', 'Illegal call to /protected-node', array(), WATCHDOG_WARNING );
    drupal_access_denied();
  }

  ...

I think there is an "exit;" missing after drupal_access_denied();