update get_result() route

[dale-wahl]

this requires a dataset key (or, if provided, can use the dataset object) to ensure user has rights to files.

one annoying caveat is that PixPlot HTML files have the route hardcoded. I need to either figure out a way to circumvent that or write a migrate script. new plots will be produced correctly.

to reduce the db requests, we could memcache the dataset data and re-instantiate the dataset object with that data. dataset.refresh_owners() would still run which has its own db requests. this only really seems relevant with something like pixplot which makes many requests for various thumbs/images.

[stijn-uva]

The implementation makes sense, but one concern I have is that this breaks existing URLs (i.e. the key is now required in the URL and old URLs won't work at all anymore). I have used direct URLs in the past to share files and now these would no longer work. So I would prefer if the key-less URLs would still work, perhaps optionally - there could be a global option "allow file downloads without login" or something.