secure filename and weird file downloading bug fixed