implement lock / unlock views, link to them from file list and file display view
locked item: render normally for admin (and offer unlocking), do not render contents / offer download for non-admins

also: fix download button, so it actually works
add missing close method to filesystem Item
fix download view for locked items: allow for admin, 403 for everybody else