fix permissions issue on media download endpoint