use x-accel-redirect to send_file so we dont have to encrypt