add auth exception for expand
add creator to url
force ssl