URLs will seemingly succeed to read a URL that points to a file whose
permissions you do not have to read.

Backport candidate once everyone agrees with the wording.