download() now takes file obj, rather than public file id/handle