displayService browser-specific tests
added non-user owner to volume create POST. Fixes #2225
Add download link to asset lists in browser
Fix locked check, which was totally broken, resulting in weird 403s

Fixes #2048