Get a file and a short-lived download URL. Needs one of profile:read, content:read, inbox:read, bookings:read: the one of the file's family (profile: user_avatar, user_cover; content: post_media, mix_audio, mix_cover, live_event_cover, live_event_flyer; inbox: message_attachment, message_voice; bookings: proposal_document). A connected app never uploads proposal_signature or proposal_pdf: signing is done on DJfindr. Answered with Cache-Control: no-store: a private file's download URL works for 15 minutes without a session or any credential, from anywhere (a fetch() from any web origin too), so treat it as a secret while it lasts.