SECURITY: prevent direct download of backups