Question: amazon S3 bucket policy - restricting access by referer BUT not restricting if urls are generated via query string authentication