So after that I figured that 'external url' could only be hit when not logged in