moved pdf-generator into a middleware
add download-route only if security-feature is enabled