only allow user owning query to download images/csv