fix security flaw for download actions

 - edited `authorized_to_download` action
 - changed redirect with render in `download_zip` action