Organization.may_access(): allow global admin always
Restrict downloads by orgs' incidents

Includes refactoring out of download handlers.