removing security makes url accessible again