download file link is now post and csrf protected.
removed debug dump