use CGI; no relative URLs