fix access so only 'access content' can see. not ideal, but it's the closest setting to plug-and-go I can think of (trying to avoid making another permission for just URL list)