found a case where the direct download url was cached, so anonymous user was not sent to login place