some more fixes to implement authorization for json URLs