avoid download flood

server side if authed, client side if not, we might like to add the recaptcha security to ensure "humanity" of downloads in all situations. it's something we might want to have if we prefer to disable possibility of someone actually trying to mess around with our local statistics, not the HTTP statistics which rely on GA, we need to think about that.