- fixed notFound responses
- sanitize filenames in download route