cookie protected urls...yuck