Use public URL, for Vemco's benefit.
Provide XML response where appropriate for unauthorised access to app.