added access control to file downloads