WebMP: Add support for token-based downloads (closes #369)

This allows download links to be used from a different PC or browser, or to
send them to a third party, which can then download only the specified item.
The tokens are valid until the server is restarted.
Merge branch 'secure-token-downloads'