Force download if guest cannot view the file

This PR is just a suggestion, but I think this is a important change. A lot of my clients say :bust_in_silhouette:  "How to hide a url of files? We want to protect files from information leaks".
If the user can view the file, they will be able to know the actual file url. Of course if administrator move the file to another storage location, the file will force download. But this PR will be more effective.