more permissive about file url