use send_file for public dump so it's authenticated