make location download loginwalled.
Merge pull request #4155 from dimagi/location-download-security

make location download loginwalled.