secured file downloads, added private url scheme for API