s3 urls can be accessed anonymously