Checked items now work

This address issue #118.  The download and delete actions work as expected.  Internally, there are two new endpoints: resource/download GET and resource DELETE.  The download can actually get item, folder, user, and collection resources, and the delete can work on any model that has a remove method.
This looks a little dirty, I'm wondering if we can get rid of it. I think we should just use the following simple logic: always use a file named "girder-metadata.json" as the metadata file. If a file with that name exists in the item, we just don't add the extra metadata file. I'm not a huge fan of in-band signaling like that, but if someone has a file called "girder-metadata.json", I feel like they must know what they are doing...