:(
encrypt non-public S3 links by default