protect files

Files are only accessible over the download controller to ensure that
the user has the needed permissions.