this should be seen through cloudfront but not through s3 url