don't allow stat-viewing of secret URLs

Apparently someone fixed this in production