[fix] secure download