I thought it made more sense for this to behave the same as `/static`, which can't be authenticated, rather than `/files`, but I'm not sure.