Good users and bad users(without permission) can access the project files
Assets are now strictly served thru the files controller
Provide an 'Add another file' link that uses javascript so that users can upload more than one file.