A service uses a customer-supplied URL to fetch documents. What should its security design prevent?

1. Only large response files, while allowing every internal address.
2. All authentication on unrelated APIs.
3. Unrestricted requests to protected internal endpoints and other unauthorized destinations.
4. Only URLs containing lowercase letters.