new URL syntax; use the store's file key instead of ID; also fix allow/deny checks with insecure