HF: cdn fix through bucket policy