note opening URLs can leak them to other users