download files to a subdior of tmp to not expose other tmp files to the
internet.

Handle empty extension