Correct download rules for embargoed files

Tester note: this must be tested as an anonymous or non-admin user;
admins always see the downloads regardless of embargo status.

Test #259