Require visitor cookie for downloads.
Reject requests for event urls.