This is our way of telling nginx to not serve anything under /protected unless the request is coming from internally, which in this case, would be the download app, and if the headers are set correctly. 

Customer goes to /saas/public/latest/unicorn.zip

/saas maps to a new python function we wrote to first authenticate/validate the user. If the user is authorized, then we redirect them (with the correct headers) to the appropriate folder under /protected.