text changes, security improvements

changed "invoices" to "documents" throughout.
Added security to downloads.
removed file suffix from download link URL