use cloudfront url instead of direct s3