everything works. prevent user go directly to mp3 or image url.