fix to force auth on protected downloads