launch external URLs & allow file uploads