use production urls, relax security note