Don't expose temp-url-key to users without read and write permission