alert('ja! only works from public URLs')