pdf files served with authentication only and uploaded via admin