THE ANATOMY OF CAP-SECURED URLS: WHAT MAKES THEM SAFE AND FUNCTIONAL