files need to be publicly readable, not bucket