Update DownloadRequestController.java

authentication level was hardcoded, therefore relying on the client to determine authentication level.