login redirect properly back to pages that dont *require* login
fixed download to have file name and extension
'you need to login to do that' message