uploaded hack doesn't work externally, but file URIs do