done with java side of taking auth out of urls