SFT URLs come from AVS and can point to any host, so this must only ever be given an unauthenticated client. Never back it with the Wire backend client.