core: box URLs can be authenticated by hooking