Add Rails CSRF protection code to files in "download" as well