fixing loophole where non git url can be accepted when private flag is not set