avoid over-releasing an NSURL

Using `CFBridgingRelease` puts the object under ARC's control