Protected Downloads

Fixes #10. Enforcing login on a page is already handled by Mezzanine. This handles assets which require the user to both be logged in and have previously signed a download agreement. These are uploaded to a subdirectory of the Media Library and then served by Nginx after the permission check. This requires a small change to the Nginx config to exclude the directory and handle the internal redirect. The agreement url also must be lined up with the slug expected in the code to handle the custom page processor and template. The agreement page itself has not been fully styled but the logic is in place. I've added some docs for the content authors as well.