I'm routing all download requests through that `/download/` endpoint, regardless of whether the artifact was put into storage by Alexandria or if the uploader posted an external download URL.  That's why I'm building that url there, but it could definitely live in the model if you think that's cleaner.