deposit: PDFs private by default

why the comment?