no csrf checks on private api
fix unique recording for event check
use proper render status values to indicate success
allow transitioning recordings from any state into downloading