move URLAccessHelper for security