download view: add check for READ permission