new, tokenless download url