Fix security hole in download.php

The file path being recieved via a get request was being blindly
accepted without sanitization. Thus, any file with the right
permissions could be downloaded by a hacker.

Fix: Make sure the directory name of the file path is either
"archives" or "songs".