xhr security for downloads. doesnt seem to be working.