also need to ensure that we don't allow relative paths in fileName to allow someone to download files that are not directly under the download directory.