Checked items now work

This address issue #118.  The download and delete actions work as expected.  Internally, there are two new endpoints: resource/download GET and resource DELETE.  The download can actually get item, folder, user, and collection resources, and the delete can work on any model that has a remove method.
Since this is just text, let's remove `escapedHtml` and it will use `text()` internally, which will prevent security regressions re XSS.