Restrict direct access to uploaded assets

Uploaded assets are now strictly served through the FilesController.