keep (secure) protocol to load external assets