All download URLs are protected by JSON Web Tokens