hotfix patch #27 now using signed urls