add auth for shock passed as direct_url