adds back in download functionality

Adds back in download functionality. Note: deploying this without modifying `downloadable?` might indirectly make private resources available to the public. Further configuration around auth is needed here.