hackable urls, disclaimer header, new cname