Don’t let unauth’d users download private downloads.

A savvy user will still be able to hack the media server URL’s
until they are moved though.