Security fix for download endpoint.