disallow unauthenticated response from molfile url