returning secure file url when aws s3 policy is not public