deposit: PDFs private by default

And for consistency shouldn't this be ```metadata['fft']['flag'] = "HIDDEN"``` ?