readme suggests using a non-http url, but we block anybody from doing that