Added patch to file_entity, removed user identifier from download token, fixed the access denied for user to download files