Set up download as a controller action, so the URL remains invisible