setObject uses urls to enforce urls and not let string filenames pass through