serve files to users who have purchased them