need to post form to store the parameters in the request body
for direct url, use ImageAnchor.  for authorized direct, use same click handler