more secure get() no longer needs url_fopen