don't expose full URL