URL signing for file downloads/uploads

[srerickson]

Currently, download links for files won't work well in web browsers because an authorization header (bearer token) needs to be included with the download request. To make it easier use chaparral with browser-based front-ends, I need to add a way to generate signed urls for restricted files.

Something like this: GetSigneDownloadURL(resource, expire) returns a URL with a (single-use?) token as a query parameter.