Required Id and Filename in media file path

Since we can't protect the media files with HTTP Auth we need to make
sure the path to the media files can't be guessed.