S3 storage: use real filename, use access token

By using an access token we prevent just anyone from viewing the links,
and allow the links to expire.